@withone/cli 1.49.0 → 1.51.0

package/README.md

@@ -179,7 +179,7 @@ Opens your browser, you authorize, done. The CLI polls until the connection is l
 
 ### `one list`
 
-List your active connections with their status and connection keys.
+List your active connections with their status, connection keys, and what your access config lets you run on each.
 
 ```bash
 one list
@@ -193,6 +193,37 @@ one list
 
 You need the connection key (rightmost column) when executing actions.
 
+**Access reporting.** Every connection carries an `access` field describing what the current [access control](#one-config) config permits — so an agent knows its reach up front instead of discovering it as a failure mid-workflow. Three policies:
+
+| Policy | Means | Shown when |
+|--------|-------|-----------|
+| `{"policy": "full"}` | Every action on the connection | Default (admin, no action allowlist) |
+| `{"policy": "methods", "methods": ["GET"]}` | Only actions with those HTTP methods | Permission level is `read` or `write` |
+| `{"policy": "actions", "actions": [{"actionId": "...", "title": "...", "method": "..."}]}` | Only these specific actions | An action allowlist is configured |
+
+An action allowlist wins over the permission level (and is then method-filtered by it). When the policy is `actions`, those actions are exactly what may run — no `actions search` needed.
+
+```jsonc
+// one --agent list
+{
+  "total": 2,
+  "showing": 2,
+  "connections": [
+    {
+      "platform": "gmail",
+      "state": "operational",
+      "key": "live::gmail::default::abc123",
+      "access": { "policy": "methods", "methods": ["GET"] }
+    }
+  ],
+  "accessHint": "Permission level \"read\": only GET actions will execute."
+}
+```
+
+`knowledgeOnly: true` appears when knowledge-only mode is on (execution disabled), and `unresolvedActionIds` lists any allowlisted action ids that could not be looked up. In human output, an `Access` column and a summary note appear only when access is actually scoped.
+
+This mirrors the `access` field on the One MCP server's `list_one_integrations` tool, so both surfaces report access the same way.
+
 ### `one connection delete <connection-key>`
 
 Remove a connection by its key.
@@ -333,10 +364,17 @@ one mem update <id> '{"status":"done"}'              # merges into data; refresh
 one mem search "design review"                       # hybrid FTS + semantic (if key set)
 one mem list note --limit 20
 
-# Identity keys are a first-class column (unique across ACTIVE records; archiving
-# frees them). Manage them after creation with `mem key` — NOT via `mem update`.
+# Merge keys (`keys[]`) are a first-class column (unique across ACTIVE records;
+# archiving frees them). Manage them after creation with `mem key` — NOT `mem update`.
 one mem key <id> --add email:x@y.com                 # also --remove / --set <csv>
 
+# Find every record tied to a person/company, grouped by type. Spans BOTH columns:
+# `keys[]` (this record IS the entity — drives merge) and `identity_keys[]` (this
+# record INVOLVES the entity — Gmail thread participants, calendar attendees; never merges).
+one mem find-by-key email:jane@acme.com              # every record carrying the key
+one mem find-by-key email:jane@acme.com --type gmail/gmailThreads
+one mem find-by-key email:jane@acme.com email:bob@acme.com   # intersection — records with BOTH
+
 # Backfill searchable_text for rows that landed NULL or with UUID-noise-heavy text
 # (drops ids/timestamps, leads with name/title/email). No embedding provider needed.
 one mem reindex --searchable --type attio/attioPeople
@@ -358,7 +396,9 @@ one mem status                                       # backend, provider, _upgra
 one mem doctor                                       # 7-check health report
 ```
 
-Key surfaces: `add`, `get`, `update`, `archive`, `list`, `search` (`--deep` forces semantic), `context`, `link`/`linked`/`unlink`, `sources`, `find-by-source`, `export`, `import`, `migrate`, `vacuum`, `reindex`. Run `one guide memory` for the full reference.
+Key surfaces: `add`, `get`, `update`, `archive`, `list`, `search` (`--deep` forces semantic), `context`, `link`/`linked`/`unlink`, `key`, `sources`, `find-by-source`, `find-by-key`, `export`, `import`, `migrate`, `vacuum`, `reindex`. Run `one guide memory` for the full reference.
+
+`find-by-key` is the cross-platform join: keys are matched **case-insensitively** (they are lowercased on write, and the query is lowercased to match), `--type` narrows to one record type, and `--limit` (default 10) caps how many records are *shown per type* while the reported per-type `count` and overall `total` stay full match counts. Above 2000 matches the response flags `truncated` and the counts become floors — re-run with `--type` for an exact answer. Populate `identity_keys[]` from a sync profile's `identityKeys` field (see `one guide sync`), which ships pre-wired for `gmail/gmailThreads`, `google-calendar/events`, and `fathom/meetings`.
 
 ### `one sync` (and `one mem sync` alias)
 
@@ -381,6 +421,10 @@ one sync test stripe/balanceTransactions --show-searchable
 # Run — every row lands in memory (SQLite also written for enrich-phase compat)
 one sync run stripe --since 90d
 one mem sync run stripe                              # identical (alias)
+# Profiles with `enrich` run a second detail pass. It enriches each record ONCE;
+# the list pass thereafter merges rather than replaces, so the enriched payload
+# survives (reported as `memPreserved`). `--full-refresh` does not re-enrich —
+# delete .one/sync/data/<platform>.db to force that.
 
 # Query + search (reads from memory)
 one sync query stripe/balanceTransactions --where "status=available" --limit 20
@@ -576,6 +620,8 @@ one config
 
 Settings propagate automatically to all installed agent configs.
 
+Run [`one list`](#one-list) to see the effect: each connection reports an `access` field describing exactly what these settings let you run on it.
+
 #### `one config skills status` / `one config skills sync`
 
 `one init` copies the packaged skill files (`SKILL.md`, `references/`) into `~/.agents/skills/one/` and symlinks per-agent paths to that canonical directory. When the CLI self-updates, the skill files in the canonical dir would normally stay frozen at the version that was installed. To prevent stale docs, every CLI command checks a `.one-cli-version` marker in the canonical dir and silently refreshes the skill files if they don't match the running CLI version. No user action required.

package/dist/{chunk-2TWFL3CS.js → chunk-D6W756DN.js}

@@ -2319,7 +2319,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-IBB42ED2.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-YDKAYGZW.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -3238,11 +3238,11 @@ export {
   ApiError,
   OneApi,
   TimeoutError,
+  PERMISSION_METHODS,
   filterByPermissions,
   isMethodAllowed,
   isActionAllowed,
   buildActionKnowledgeWithGuidance,
-  validateActionInput,
   knowledgeCachePath,
   searchCachePath,
   readCache,
@@ -3256,6 +3256,7 @@ export {
   clearEntry,
   makeCacheEntry,
   resolveActionDetails,
+  validateActionInput,
   FLOW_SCHEMA,
   getStepTypeDescriptor,
   getNestedStepsKeys,

package/dist/{chunk-4WWK3GO5.js → chunk-UV4YYDF3.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-CLJFSFFM.js";
 import {
   getBackend
-} from "./chunk-7RV7T5PX.js";
+} from "./chunk-Z4KAQGIG.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-7RV7T5PX.js → chunk-Z4KAQGIG.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-SO323PZP.js";
 
 // src/lib/memory/schema.ts
-var SCHEMA_VERSION = "2.2.0";
+var SCHEMA_VERSION = "2.3.1";
 var EXTENSIONS_SQL = ``;
 var VECTOR_EXTENSION_SQL = `
 CREATE EXTENSION IF NOT EXISTS vector;
@@ -24,6 +24,14 @@ CREATE TABLE IF NOT EXISTS mem_records (
     data JSONB NOT NULL,
     tags TEXT[],
     keys TEXT[],
+    -- Cross-platform identity keys (#128): queryable associations like
+    -- email:jane@acme.com for every participant of a record. UNLIKE keys[],
+    -- these are NOT merge identifiers \u2014 they are exempt from the
+    -- key-uniqueness trigger and the upsert overlap-merge, so a Gmail thread
+    -- carrying many participant emails stays its own record instead of
+    -- collapsing into a contact (or into every other thread that shares a
+    -- participant). Queried by "mem find-by-key".
+    identity_keys TEXT[],
 
     sources JSONB NOT NULL DEFAULT '{}',
 
@@ -72,6 +80,12 @@ CREATE TABLE IF NOT EXISTS mem_meta (
     value TEXT NOT NULL,
     updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
+
+-- Additive migration for stores created before identity_keys existed (#128).
+-- Safe to re-run; existing rows get identity_keys populated lazily on their
+-- next sync. CREATE TABLE IF NOT EXISTS above won't add columns to a table
+-- that already exists, so the ALTER is required for upgrades.
+ALTER TABLE mem_records ADD COLUMN IF NOT EXISTS identity_keys TEXT[];
 `;
 var VECTOR_COLUMNS_SQL = `
 ALTER TABLE mem_records ADD COLUMN IF NOT EXISTS embedding vector(1536);
@@ -82,6 +96,7 @@ var INDEXES_SQL = `
 CREATE INDEX IF NOT EXISTS idx_records_type         ON mem_records(type);
 CREATE INDEX IF NOT EXISTS idx_records_status       ON mem_records(status);
 CREATE INDEX IF NOT EXISTS idx_records_keys         ON mem_records USING GIN(keys);
+CREATE INDEX IF NOT EXISTS idx_records_identity_keys ON mem_records USING GIN(identity_keys);
 CREATE INDEX IF NOT EXISTS idx_records_tags         ON mem_records USING GIN(tags);
 CREATE INDEX IF NOT EXISTS idx_records_data         ON mem_records USING GIN(data jsonb_path_ops);
 CREATE INDEX IF NOT EXISTS idx_records_sources      ON mem_records USING GIN(sources jsonb_path_ops);
@@ -105,6 +120,25 @@ BEGIN
 END $$;
 `;
 var FUNCTIONS_SQL = `
+-- Drop the pre-#128 11-argument mem_upsert_by_keys (no p_identity_keys).
+--
+-- CREATE OR REPLACE cannot change a function's argument list \u2014 adding
+-- \`p_identity_keys TEXT[] DEFAULT NULL\` defines a SECOND function rather
+-- than replacing the old one. An upgraded store would then hold both
+-- overloads in pg_proc, and because the 12-arg version's trailing param is
+-- defaultable, an 11-arg call matches BOTH and fails with 42725
+-- "function mem_upsert_by_keys(...) is not unique". Verified on PGlite.
+--
+-- The explicit argument list makes this unambiguous (no 42725 on the DROP
+-- itself) and leaves the 12-arg version untouched, so re-running the block
+-- is a no-op. Only needed here, not in VECTOR_FUNCTIONS_SQL: the vector
+-- variant is a same-signature CREATE OR REPLACE that always runs AFTER this
+-- block (ensureSchema and getFullSchemaSQL both order core functions before
+-- vector functions), so by the time it runs the stale 11-arg entry \u2014 whether
+-- it was last written by the core or the vector block \u2014 is already gone.
+DROP FUNCTION IF EXISTS mem_upsert_by_keys(
+  TEXT, JSONB, TEXT[], TEXT[], JSONB, TEXT, TEXT, INTEGER, TEXT, TEXT, BOOLEAN);
+
 -- Enforce uniqueness of the "keys" array across ACTIVE records only.
 --
 -- Scoping to active is deliberate: an archived record must not squat on a
@@ -227,7 +261,8 @@ CREATE OR REPLACE FUNCTION mem_upsert_by_keys(
     p_weight INTEGER DEFAULT NULL,
     p_embedding TEXT DEFAULT NULL,
     p_embedding_model TEXT DEFAULT NULL,
-    p_replace BOOLEAN DEFAULT FALSE
+    p_replace BOOLEAN DEFAULT FALSE,
+    p_identity_keys TEXT[] DEFAULT NULL
 ) RETURNS TABLE (id UUID, action TEXT) LANGUAGE plpgsql AS $$
 DECLARE
     existing_id UUID;
@@ -262,6 +297,23 @@ BEGIN
                 ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.tags, '{}') || COALESCE(p_tags, '{}'))))
             END,
             keys = (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.keys, '{}') || COALESCE(p_keys, '{}')))),
+            -- identity_keys: replace on a replace-sync, otherwise union (never
+            -- drop an association). NOT part of the overlap-merge above.
+            -- Three states, and NULL is NOT the same as '{}' here:
+            --   NULL  \u2192 caller has no opinion (profile declares no
+            --           identityKeys, or the record is still the pre-enrich
+            --           shape whose participant fields haven't been fetched
+            --           yet) \u2192 KEEP what's stored. Clearing on NULL made
+            --           every sync after the first wipe the column, because
+            --           the unconditional list-phase write resolves nothing
+            --           and enrich only revisits _enriched_at IS NULL rows.
+            --   '{}'  \u2192 caller authoritatively resolved zero participants
+            --           \u2192 clear, so a removed attendee really disappears.
+            --   {a,b} \u2192 replace with exactly these.
+            identity_keys = CASE
+                WHEN p_replace THEN COALESCE(p_identity_keys, r.identity_keys)
+                ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.identity_keys, '{}') || COALESCE(p_identity_keys, '{}'))))
+            END,
             sources = r.sources || COALESCE(p_sources, '{}'::jsonb),
             searchable_text = CASE
                 WHEN p_replace THEN p_searchable_text
@@ -280,12 +332,13 @@ BEGIN
         result_action := 'updated';
     ELSE
         INSERT INTO mem_records (
-            type, data, tags, keys, sources, searchable_text, content_hash, weight
+            type, data, tags, keys, identity_keys, sources, searchable_text, content_hash, weight
         ) VALUES (
             p_type,
             p_data,
             p_tags,
             p_keys,
+            p_identity_keys,
             COALESCE(p_sources, '{}'::jsonb),
             p_searchable_text,
             p_content_hash,
@@ -311,7 +364,8 @@ CREATE OR REPLACE FUNCTION mem_upsert_by_keys(
     p_weight INTEGER DEFAULT NULL,
     p_embedding TEXT DEFAULT NULL,
     p_embedding_model TEXT DEFAULT NULL,
-    p_replace BOOLEAN DEFAULT FALSE
+    p_replace BOOLEAN DEFAULT FALSE,
+    p_identity_keys TEXT[] DEFAULT NULL
 ) RETURNS TABLE (id UUID, action TEXT) LANGUAGE plpgsql AS $$
 DECLARE
     existing_id UUID;
@@ -340,6 +394,13 @@ BEGIN
                 ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.tags, '{}') || COALESCE(p_tags, '{}'))))
             END,
             keys = (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.keys, '{}') || COALESCE(p_keys, '{}')))),
+            -- identity_keys: replace on replace-sync, else union. Not part of
+            -- the overlap-merge. NULL keeps, '{}' clears, non-empty replaces \u2014
+            -- see the no-vector variant for why NULL must not clear.
+            identity_keys = CASE
+                WHEN p_replace THEN COALESCE(p_identity_keys, r.identity_keys)
+                ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.identity_keys, '{}') || COALESCE(p_identity_keys, '{}'))))
+            END,
             sources = r.sources || COALESCE(p_sources, '{}'::jsonb),
             searchable_text = CASE
                 WHEN p_replace THEN p_searchable_text
@@ -361,13 +422,14 @@ BEGIN
         result_action := 'updated';
     ELSE
         INSERT INTO mem_records (
-            type, data, tags, keys, sources, searchable_text, content_hash,
+            type, data, tags, keys, identity_keys, sources, searchable_text, content_hash,
             weight, embedding, embedded_at, embedding_model
         ) VALUES (
             p_type,
             p_data,
             p_tags,
             p_keys,
+            p_identity_keys,
             COALESCE(p_sources, '{}'::jsonb),
             p_searchable_text,
             p_content_hash,
@@ -505,6 +567,7 @@ function toRecord(row) {
     data: row.data,
     tags: row.tags ?? void 0,
     keys: row.keys ?? void 0,
+    identity_keys: row.identity_keys ?? void 0,
     sources: row.sources ?? {},
     searchable_text: row.searchable_text,
     embedded_at: row.embedded_at,
@@ -533,7 +596,17 @@ var CoreBackend = class {
   async ensureSchema() {
     const caps = this.caps;
     try {
-      if (await this.getSchemaVersion() === SCHEMA_VERSION) return;
+      const probe = await this.client.query(
+        `SELECT (SELECT value FROM mem_meta WHERE key = 'version') AS version,
+                EXISTS (
+                  SELECT 1 FROM pg_attribute
+                   WHERE attrelid = to_regclass('mem_records')
+                     AND attname = 'identity_keys'
+                     AND NOT attisdropped
+                ) AS has_sentinel`
+      );
+      const probed = probe.rows[0];
+      if (probed?.version === SCHEMA_VERSION && probed.has_sentinel) return;
     } catch {
     }
     await this.client.transaction(async (tx) => {
@@ -565,19 +638,20 @@ var CoreBackend = class {
   async insert(row) {
     const embedding = vectorLiteral(row.embedding ?? null);
     const sql = this.caps.vectorSearch ? `INSERT INTO mem_records
-          (type, data, tags, keys, sources, searchable_text, content_hash, weight,
+          (type, data, tags, keys, identity_keys, sources, searchable_text, content_hash, weight,
            embedding, embedded_at, embedding_model)
-         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::jsonb, $6, $7, $8,
-                 $9::vector, CASE WHEN $9 IS NOT NULL THEN NOW() ELSE NULL END, $10)
+         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::text[], $6::jsonb, $7, $8, $9,
+                 $10::vector, CASE WHEN $10 IS NOT NULL THEN NOW() ELSE NULL END, $11)
          RETURNING *` : `INSERT INTO mem_records
-          (type, data, tags, keys, sources, searchable_text, content_hash, weight)
-         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::jsonb, $6, $7, $8)
+          (type, data, tags, keys, identity_keys, sources, searchable_text, content_hash, weight)
+         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::text[], $6::jsonb, $7, $8, $9)
          RETURNING *`;
     const params = this.caps.vectorSearch ? [
       row.type,
       JSON.stringify(row.data),
       row.tags ?? null,
       row.keys ?? null,
+      row.identity_keys ?? null,
       JSON.stringify(row.sources ?? {}),
       row.searchable_text ?? null,
       row.content_hash ?? null,
@@ -589,6 +663,7 @@ var CoreBackend = class {
       JSON.stringify(row.data),
       row.tags ?? null,
       row.keys ?? null,
+      row.identity_keys ?? null,
       JSON.stringify(row.sources ?? {}),
       row.searchable_text ?? null,
       row.content_hash ?? null,
@@ -603,7 +678,7 @@ var CoreBackend = class {
     const res = await this.client.query(
       `SELECT id, action FROM mem_upsert_by_keys(
           $1::text, $2::jsonb, $3::text[], $4::text[], $5::jsonb, $6::text, $7::text,
-          $8::integer, $9::text, $10::text, $11::boolean
+          $8::integer, $9::text, $10::text, $11::boolean, $12::text[]
        )`,
       [
         row.type,
@@ -616,7 +691,8 @@ var CoreBackend = class {
         row.weight ?? null,
         embedding,
         embeddingModel,
-        opts.replace ?? false
+        opts.replace ?? false,
+        row.identity_keys ?? null
       ]
     );
     const { id, action } = res.rows[0];
@@ -999,6 +1075,48 @@ var CoreBackend = class {
     );
     return res.rows[0] ? toRecord(res.rows[0]) : null;
   }
+  async findByKeys(keys, opts = {}) {
+    if (!keys.length) return [];
+    const params = [keys];
+    const where = [
+      // Index-usable prefilter. The exact predicate below concatenates two
+      // columns, which is an expression neither GIN index can answer — on its
+      // own it plans as a Filter over a full scan, making
+      // idx_records_identity_keys pure write cost. Overlap (`&&`) on the bare
+      // columns IS index-usable and is a valid necessary condition here:
+      // containment of a NON-EMPTY $1 implies every element is present, so at
+      // least one element must overlap one of the two columns ($1 is guarded
+      // non-empty by the early return above). The planner ORs the two bitmap
+      // index scans, then the exact recheck drops rows that only partially
+      // match.
+      //
+      // The columns MUST stay bare. Wrapping either in COALESCE turns it back
+      // into an expression over a non-indexed value and the plan collapses to
+      // a full scan again (measured) — do not "tidy" this into COALESCE for
+      // symmetry with the line below. NULL && anything is NULL → not true,
+      // which is exactly right: a record with no keys can't contain any.
+      `(keys && $1::text[] OR identity_keys && $1::text[])`,
+      `(COALESCE(keys, '{}'::text[]) || COALESCE(identity_keys, '{}'::text[])) @> $1::text[]`
+    ];
+    const status = opts.status ?? "active";
+    if (status !== "all") {
+      params.push(status);
+      where.push(`status = $${params.length}`);
+    }
+    if (opts.type) {
+      params.push(opts.type);
+      where.push(`type = $${params.length}`);
+    }
+    params.push(Math.min(opts.limit ?? 2e3, 5e3));
+    const res = await this.client.query(
+      `SELECT * FROM mem_records
+        WHERE ${where.join(" AND ")}
+        ORDER BY type ASC, updated_at DESC NULLS LAST
+        LIMIT $${params.length}`,
+      params
+    );
+    return res.rows.map(toRecord);
+  }
   async listSources(recordId) {
     const res = await this.client.query(
       `SELECT sources FROM mem_records WHERE id = $1`,
@@ -1293,6 +1411,9 @@ var LazyPostgresBackend = class {
   async findBySource(...a) {
     return (await this.ensure()).findBySource(...a);
   }
+  async findByKeys(...a) {
+    return (await this.ensure()).findByKeys(...a);
+  }
   async listSources(...a) {
     return (await this.ensure()).listSources(...a);
   }
@@ -1648,6 +1769,9 @@ var LazyEmbeddedPostgresBackend = class {
   async findBySource(...a) {
     return (await this.ensure()).findBySource(...a);
   }
+  async findByKeys(...a) {
+    return (await this.ensure()).findByKeys(...a);
+  }
   async listSources(...a) {
     return (await this.ensure()).listSources(...a);
   }
@@ -1832,8 +1956,8 @@ async function upsertRecord(input, opts = {}) {
   const { searchable_text, content_hash, embedding, embedding_model } = await prepareRecord(input, opts, "sync");
   const prepared = {
     ...input,
-    searchable_text: input.searchable_text ?? searchable_text,
-    content_hash: input.content_hash ?? content_hash,
+    searchable_text: opts.preserveDerived ? void 0 : input.searchable_text ?? searchable_text,
+    content_hash: opts.preserveDerived ? void 0 : input.content_hash ?? content_hash,
     embedding,
     embedding_model
   };