@withone/cli 1.50.0 → 1.52.0

package/README.md

@@ -364,10 +364,17 @@ one mem update <id> '{"status":"done"}'              # merges into data; refresh
 one mem search "design review"                       # hybrid FTS + semantic (if key set)
 one mem list note --limit 20
 
-# Identity keys are a first-class column (unique across ACTIVE records; archiving
-# frees them). Manage them after creation with `mem key` — NOT via `mem update`.
+# Merge keys (`keys[]`) are a first-class column (unique across ACTIVE records;
+# archiving frees them). Manage them after creation with `mem key` — NOT `mem update`.
 one mem key <id> --add email:x@y.com                 # also --remove / --set <csv>
 
+# Find every record tied to a person/company, grouped by type. Spans BOTH columns:
+# `keys[]` (this record IS the entity — drives merge) and `identity_keys[]` (this
+# record INVOLVES the entity — Gmail thread participants, calendar attendees; never merges).
+one mem find-by-key email:jane@acme.com              # every record carrying the key
+one mem find-by-key email:jane@acme.com --type gmail/gmailThreads
+one mem find-by-key email:jane@acme.com email:bob@acme.com   # intersection — records with BOTH
+
 # Backfill searchable_text for rows that landed NULL or with UUID-noise-heavy text
 # (drops ids/timestamps, leads with name/title/email). No embedding provider needed.
 one mem reindex --searchable --type attio/attioPeople
@@ -389,7 +396,9 @@ one mem status                                       # backend, provider, _upgra
 one mem doctor                                       # 7-check health report
 ```
 
-Key surfaces: `add`, `get`, `update`, `archive`, `list`, `search` (`--deep` forces semantic), `context`, `link`/`linked`/`unlink`, `sources`, `find-by-source`, `export`, `import`, `migrate`, `vacuum`, `reindex`. Run `one guide memory` for the full reference.
+Key surfaces: `add`, `get`, `update`, `archive`, `list`, `search` (`--deep` forces semantic), `context`, `link`/`linked`/`unlink`, `key`, `sources`, `find-by-source`, `find-by-key`, `export`, `import`, `migrate`, `vacuum`, `reindex`. Run `one guide memory` for the full reference.
+
+`find-by-key` is the cross-platform join: keys are matched **case-insensitively** (they are lowercased on write, and the query is lowercased to match), `--type` narrows to one record type, and `--limit` (default 10) caps how many records are *shown per type* while the reported per-type `count` and overall `total` stay full match counts. Above 2000 matches the response flags `truncated` and the counts become floors — re-run with `--type` for an exact answer. Populate `identity_keys[]` from a sync profile's `identityKeys` field (see `one guide sync`), which ships pre-wired for `gmail/gmailThreads`, `google-calendar/events`, and `fathom/meetings`.
 
 ### `one sync` (and `one mem sync` alias)
 
@@ -412,6 +421,10 @@ one sync test stripe/balanceTransactions --show-searchable
 # Run — every row lands in memory (SQLite also written for enrich-phase compat)
 one sync run stripe --since 90d
 one mem sync run stripe                              # identical (alias)
+# Profiles with `enrich` run a second detail pass. It enriches each record ONCE;
+# the list pass thereafter merges rather than replaces, so the enriched payload
+# survives (reported as `memPreserved`). `--full-refresh` does not re-enrich —
+# delete .one/sync/data/<platform>.db to force that.
 
 # Query + search (reads from memory)
 one sync query stripe/balanceTransactions --where "status=available" --limit 20

package/dist/{chunk-D6W756DN.js → chunk-K56Z5BTM.js}

@@ -1039,6 +1039,7 @@ var FLOW_SCHEMA = {
         command: { type: "string", required: true, description: "Shell command to execute (supports selectors)" },
         timeout: { type: "number", required: false, description: "Timeout in ms (default: 30000)" },
         parseJson: { type: "boolean", required: false, description: "Parse stdout as JSON (default: false). When true, $.steps.<id>.output is the parsed object/array; when false, it is the trimmed stdout string." },
+        parseEnvelope: { type: "boolean", required: false, description: "Unwrap a `claude --print --output-format json` envelope: extract .result, strip code fences + preamble, parse the inner JSON as $.steps.<id>.output. Use this (instead of parseJson) for claude --print steps. Fails the step if the unwrapped payload isn't valid JSON." },
         cwd: { type: "string", required: false, description: "Working directory (supports selectors)" },
         env: { type: "object", required: false, description: "Additional environment variables" }
       },
@@ -1049,7 +1050,7 @@ var FLOW_SCHEMA = {
         bash: {
           command: "cat /tmp/data.json | claude --print 'Analyze this data' --output-format json",
           timeout: 18e4,
-          parseJson: true
+          parseEnvelope: true
         }
       }
     }
@@ -1986,6 +1987,40 @@ function stripCodeFences(text) {
   const match = trimmed.match(/^```(?:\w*)\s*\n([\s\S]*?)\n\s*```\s*$/);
   return match ? match[1].trim() : trimmed;
 }
+function stripToJson(text) {
+  const s = stripCodeFences(text);
+  const candidates = [s.indexOf("{"), s.indexOf("[")].filter((i) => i >= 0);
+  if (candidates.length === 0) return s;
+  const start = Math.min(...candidates);
+  const end = Math.max(s.lastIndexOf("}"), s.lastIndexOf("]"));
+  return end > start ? s.slice(start, end + 1) : s;
+}
+function unwrapClaudeEnvelope(stdout, stepId) {
+  const trimmed = stdout.trim();
+  let envelope;
+  try {
+    envelope = JSON.parse(trimmed);
+  } catch {
+    envelope = trimmed;
+  }
+  let resultText;
+  if (envelope && typeof envelope === "object" && !Array.isArray(envelope) && envelope.type === "result" && typeof envelope.result === "string") {
+    resultText = envelope.result;
+  } else if (typeof envelope === "string") {
+    resultText = envelope;
+  } else {
+    return envelope;
+  }
+  const payload = stripToJson(resultText);
+  try {
+    return JSON.parse(payload);
+  } catch (err) {
+    const snippet = payload.length > 200 ? `${payload.slice(0, 200)}\u2026` : payload;
+    throw new Error(
+      `Bash step "${stepId}" parseEnvelope: claude output was not valid JSON after unwrapping (${err instanceof Error ? err.message : String(err)}). Got: ${snippet}`
+    );
+  }
+}
 async function executeActionStep(step, context, api, permissions, allowedActionIds, options) {
   const action = step.action;
   const platform = resolveValue(action.platform, context);
@@ -2319,7 +2354,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-YDKAYGZW.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-WZIYXW47.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -2464,7 +2499,7 @@ async function executeBashStep(step, context, options) {
       env,
       maxBuffer: 10 * 1024 * 1024
     });
-    const output = config.parseJson ? JSON.parse(stripCodeFences(stdout)) : stdout.trim();
+    const output = config.parseEnvelope ? unwrapClaudeEnvelope(stdout, step.id) : config.parseJson ? JSON.parse(stripCodeFences(stdout)) : stdout.trim();
     return {
       status: "success",
       output,

package/dist/{chunk-4WWK3GO5.js → chunk-UV4YYDF3.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-CLJFSFFM.js";
 import {
   getBackend
-} from "./chunk-7RV7T5PX.js";
+} from "./chunk-Z4KAQGIG.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-7RV7T5PX.js → chunk-Z4KAQGIG.js}

@@ -11,7 +11,7 @@ import {
 } from "./chunk-SO323PZP.js";
 
 // src/lib/memory/schema.ts
-var SCHEMA_VERSION = "2.2.0";
+var SCHEMA_VERSION = "2.3.1";
 var EXTENSIONS_SQL = ``;
 var VECTOR_EXTENSION_SQL = `
 CREATE EXTENSION IF NOT EXISTS vector;
@@ -24,6 +24,14 @@ CREATE TABLE IF NOT EXISTS mem_records (
     data JSONB NOT NULL,
     tags TEXT[],
     keys TEXT[],
+    -- Cross-platform identity keys (#128): queryable associations like
+    -- email:jane@acme.com for every participant of a record. UNLIKE keys[],
+    -- these are NOT merge identifiers \u2014 they are exempt from the
+    -- key-uniqueness trigger and the upsert overlap-merge, so a Gmail thread
+    -- carrying many participant emails stays its own record instead of
+    -- collapsing into a contact (or into every other thread that shares a
+    -- participant). Queried by "mem find-by-key".
+    identity_keys TEXT[],
 
     sources JSONB NOT NULL DEFAULT '{}',
 
@@ -72,6 +80,12 @@ CREATE TABLE IF NOT EXISTS mem_meta (
     value TEXT NOT NULL,
     updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
 );
+
+-- Additive migration for stores created before identity_keys existed (#128).
+-- Safe to re-run; existing rows get identity_keys populated lazily on their
+-- next sync. CREATE TABLE IF NOT EXISTS above won't add columns to a table
+-- that already exists, so the ALTER is required for upgrades.
+ALTER TABLE mem_records ADD COLUMN IF NOT EXISTS identity_keys TEXT[];
 `;
 var VECTOR_COLUMNS_SQL = `
 ALTER TABLE mem_records ADD COLUMN IF NOT EXISTS embedding vector(1536);
@@ -82,6 +96,7 @@ var INDEXES_SQL = `
 CREATE INDEX IF NOT EXISTS idx_records_type         ON mem_records(type);
 CREATE INDEX IF NOT EXISTS idx_records_status       ON mem_records(status);
 CREATE INDEX IF NOT EXISTS idx_records_keys         ON mem_records USING GIN(keys);
+CREATE INDEX IF NOT EXISTS idx_records_identity_keys ON mem_records USING GIN(identity_keys);
 CREATE INDEX IF NOT EXISTS idx_records_tags         ON mem_records USING GIN(tags);
 CREATE INDEX IF NOT EXISTS idx_records_data         ON mem_records USING GIN(data jsonb_path_ops);
 CREATE INDEX IF NOT EXISTS idx_records_sources      ON mem_records USING GIN(sources jsonb_path_ops);
@@ -105,6 +120,25 @@ BEGIN
 END $$;
 `;
 var FUNCTIONS_SQL = `
+-- Drop the pre-#128 11-argument mem_upsert_by_keys (no p_identity_keys).
+--
+-- CREATE OR REPLACE cannot change a function's argument list \u2014 adding
+-- \`p_identity_keys TEXT[] DEFAULT NULL\` defines a SECOND function rather
+-- than replacing the old one. An upgraded store would then hold both
+-- overloads in pg_proc, and because the 12-arg version's trailing param is
+-- defaultable, an 11-arg call matches BOTH and fails with 42725
+-- "function mem_upsert_by_keys(...) is not unique". Verified on PGlite.
+--
+-- The explicit argument list makes this unambiguous (no 42725 on the DROP
+-- itself) and leaves the 12-arg version untouched, so re-running the block
+-- is a no-op. Only needed here, not in VECTOR_FUNCTIONS_SQL: the vector
+-- variant is a same-signature CREATE OR REPLACE that always runs AFTER this
+-- block (ensureSchema and getFullSchemaSQL both order core functions before
+-- vector functions), so by the time it runs the stale 11-arg entry \u2014 whether
+-- it was last written by the core or the vector block \u2014 is already gone.
+DROP FUNCTION IF EXISTS mem_upsert_by_keys(
+  TEXT, JSONB, TEXT[], TEXT[], JSONB, TEXT, TEXT, INTEGER, TEXT, TEXT, BOOLEAN);
+
 -- Enforce uniqueness of the "keys" array across ACTIVE records only.
 --
 -- Scoping to active is deliberate: an archived record must not squat on a
@@ -227,7 +261,8 @@ CREATE OR REPLACE FUNCTION mem_upsert_by_keys(
     p_weight INTEGER DEFAULT NULL,
     p_embedding TEXT DEFAULT NULL,
     p_embedding_model TEXT DEFAULT NULL,
-    p_replace BOOLEAN DEFAULT FALSE
+    p_replace BOOLEAN DEFAULT FALSE,
+    p_identity_keys TEXT[] DEFAULT NULL
 ) RETURNS TABLE (id UUID, action TEXT) LANGUAGE plpgsql AS $$
 DECLARE
     existing_id UUID;
@@ -262,6 +297,23 @@ BEGIN
                 ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.tags, '{}') || COALESCE(p_tags, '{}'))))
             END,
             keys = (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.keys, '{}') || COALESCE(p_keys, '{}')))),
+            -- identity_keys: replace on a replace-sync, otherwise union (never
+            -- drop an association). NOT part of the overlap-merge above.
+            -- Three states, and NULL is NOT the same as '{}' here:
+            --   NULL  \u2192 caller has no opinion (profile declares no
+            --           identityKeys, or the record is still the pre-enrich
+            --           shape whose participant fields haven't been fetched
+            --           yet) \u2192 KEEP what's stored. Clearing on NULL made
+            --           every sync after the first wipe the column, because
+            --           the unconditional list-phase write resolves nothing
+            --           and enrich only revisits _enriched_at IS NULL rows.
+            --   '{}'  \u2192 caller authoritatively resolved zero participants
+            --           \u2192 clear, so a removed attendee really disappears.
+            --   {a,b} \u2192 replace with exactly these.
+            identity_keys = CASE
+                WHEN p_replace THEN COALESCE(p_identity_keys, r.identity_keys)
+                ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.identity_keys, '{}') || COALESCE(p_identity_keys, '{}'))))
+            END,
             sources = r.sources || COALESCE(p_sources, '{}'::jsonb),
             searchable_text = CASE
                 WHEN p_replace THEN p_searchable_text
@@ -280,12 +332,13 @@ BEGIN
         result_action := 'updated';
     ELSE
         INSERT INTO mem_records (
-            type, data, tags, keys, sources, searchable_text, content_hash, weight
+            type, data, tags, keys, identity_keys, sources, searchable_text, content_hash, weight
         ) VALUES (
             p_type,
             p_data,
             p_tags,
             p_keys,
+            p_identity_keys,
             COALESCE(p_sources, '{}'::jsonb),
             p_searchable_text,
             p_content_hash,
@@ -311,7 +364,8 @@ CREATE OR REPLACE FUNCTION mem_upsert_by_keys(
     p_weight INTEGER DEFAULT NULL,
     p_embedding TEXT DEFAULT NULL,
     p_embedding_model TEXT DEFAULT NULL,
-    p_replace BOOLEAN DEFAULT FALSE
+    p_replace BOOLEAN DEFAULT FALSE,
+    p_identity_keys TEXT[] DEFAULT NULL
 ) RETURNS TABLE (id UUID, action TEXT) LANGUAGE plpgsql AS $$
 DECLARE
     existing_id UUID;
@@ -340,6 +394,13 @@ BEGIN
                 ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.tags, '{}') || COALESCE(p_tags, '{}'))))
             END,
             keys = (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.keys, '{}') || COALESCE(p_keys, '{}')))),
+            -- identity_keys: replace on replace-sync, else union. Not part of
+            -- the overlap-merge. NULL keeps, '{}' clears, non-empty replaces \u2014
+            -- see the no-vector variant for why NULL must not clear.
+            identity_keys = CASE
+                WHEN p_replace THEN COALESCE(p_identity_keys, r.identity_keys)
+                ELSE (SELECT ARRAY(SELECT DISTINCT unnest FROM unnest(COALESCE(r.identity_keys, '{}') || COALESCE(p_identity_keys, '{}'))))
+            END,
             sources = r.sources || COALESCE(p_sources, '{}'::jsonb),
             searchable_text = CASE
                 WHEN p_replace THEN p_searchable_text
@@ -361,13 +422,14 @@ BEGIN
         result_action := 'updated';
     ELSE
         INSERT INTO mem_records (
-            type, data, tags, keys, sources, searchable_text, content_hash,
+            type, data, tags, keys, identity_keys, sources, searchable_text, content_hash,
             weight, embedding, embedded_at, embedding_model
         ) VALUES (
             p_type,
             p_data,
             p_tags,
             p_keys,
+            p_identity_keys,
             COALESCE(p_sources, '{}'::jsonb),
             p_searchable_text,
             p_content_hash,
@@ -505,6 +567,7 @@ function toRecord(row) {
     data: row.data,
     tags: row.tags ?? void 0,
     keys: row.keys ?? void 0,
+    identity_keys: row.identity_keys ?? void 0,
     sources: row.sources ?? {},
     searchable_text: row.searchable_text,
     embedded_at: row.embedded_at,
@@ -533,7 +596,17 @@ var CoreBackend = class {
   async ensureSchema() {
     const caps = this.caps;
     try {
-      if (await this.getSchemaVersion() === SCHEMA_VERSION) return;
+      const probe = await this.client.query(
+        `SELECT (SELECT value FROM mem_meta WHERE key = 'version') AS version,
+                EXISTS (
+                  SELECT 1 FROM pg_attribute
+                   WHERE attrelid = to_regclass('mem_records')
+                     AND attname = 'identity_keys'
+                     AND NOT attisdropped
+                ) AS has_sentinel`
+      );
+      const probed = probe.rows[0];
+      if (probed?.version === SCHEMA_VERSION && probed.has_sentinel) return;
     } catch {
     }
     await this.client.transaction(async (tx) => {
@@ -565,19 +638,20 @@ var CoreBackend = class {
   async insert(row) {
     const embedding = vectorLiteral(row.embedding ?? null);
     const sql = this.caps.vectorSearch ? `INSERT INTO mem_records
-          (type, data, tags, keys, sources, searchable_text, content_hash, weight,
+          (type, data, tags, keys, identity_keys, sources, searchable_text, content_hash, weight,
            embedding, embedded_at, embedding_model)
-         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::jsonb, $6, $7, $8,
-                 $9::vector, CASE WHEN $9 IS NOT NULL THEN NOW() ELSE NULL END, $10)
+         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::text[], $6::jsonb, $7, $8, $9,
+                 $10::vector, CASE WHEN $10 IS NOT NULL THEN NOW() ELSE NULL END, $11)
          RETURNING *` : `INSERT INTO mem_records
-          (type, data, tags, keys, sources, searchable_text, content_hash, weight)
-         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::jsonb, $6, $7, $8)
+          (type, data, tags, keys, identity_keys, sources, searchable_text, content_hash, weight)
+         VALUES ($1, $2::jsonb, $3::text[], $4::text[], $5::text[], $6::jsonb, $7, $8, $9)
          RETURNING *`;
     const params = this.caps.vectorSearch ? [
       row.type,
       JSON.stringify(row.data),
       row.tags ?? null,
       row.keys ?? null,
+      row.identity_keys ?? null,
       JSON.stringify(row.sources ?? {}),
       row.searchable_text ?? null,
       row.content_hash ?? null,
@@ -589,6 +663,7 @@ var CoreBackend = class {
       JSON.stringify(row.data),
       row.tags ?? null,
       row.keys ?? null,
+      row.identity_keys ?? null,
       JSON.stringify(row.sources ?? {}),
       row.searchable_text ?? null,
       row.content_hash ?? null,
@@ -603,7 +678,7 @@ var CoreBackend = class {
     const res = await this.client.query(
       `SELECT id, action FROM mem_upsert_by_keys(
           $1::text, $2::jsonb, $3::text[], $4::text[], $5::jsonb, $6::text, $7::text,
-          $8::integer, $9::text, $10::text, $11::boolean
+          $8::integer, $9::text, $10::text, $11::boolean, $12::text[]
        )`,
       [
         row.type,
@@ -616,7 +691,8 @@ var CoreBackend = class {
         row.weight ?? null,
         embedding,
         embeddingModel,
-        opts.replace ?? false
+        opts.replace ?? false,
+        row.identity_keys ?? null
       ]
     );
     const { id, action } = res.rows[0];
@@ -999,6 +1075,48 @@ var CoreBackend = class {
     );
     return res.rows[0] ? toRecord(res.rows[0]) : null;
   }
+  async findByKeys(keys, opts = {}) {
+    if (!keys.length) return [];
+    const params = [keys];
+    const where = [
+      // Index-usable prefilter. The exact predicate below concatenates two
+      // columns, which is an expression neither GIN index can answer — on its
+      // own it plans as a Filter over a full scan, making
+      // idx_records_identity_keys pure write cost. Overlap (`&&`) on the bare
+      // columns IS index-usable and is a valid necessary condition here:
+      // containment of a NON-EMPTY $1 implies every element is present, so at
+      // least one element must overlap one of the two columns ($1 is guarded
+      // non-empty by the early return above). The planner ORs the two bitmap
+      // index scans, then the exact recheck drops rows that only partially
+      // match.
+      //
+      // The columns MUST stay bare. Wrapping either in COALESCE turns it back
+      // into an expression over a non-indexed value and the plan collapses to
+      // a full scan again (measured) — do not "tidy" this into COALESCE for
+      // symmetry with the line below. NULL && anything is NULL → not true,
+      // which is exactly right: a record with no keys can't contain any.
+      `(keys && $1::text[] OR identity_keys && $1::text[])`,
+      `(COALESCE(keys, '{}'::text[]) || COALESCE(identity_keys, '{}'::text[])) @> $1::text[]`
+    ];
+    const status = opts.status ?? "active";
+    if (status !== "all") {
+      params.push(status);
+      where.push(`status = $${params.length}`);
+    }
+    if (opts.type) {
+      params.push(opts.type);
+      where.push(`type = $${params.length}`);
+    }
+    params.push(Math.min(opts.limit ?? 2e3, 5e3));
+    const res = await this.client.query(
+      `SELECT * FROM mem_records
+        WHERE ${where.join(" AND ")}
+        ORDER BY type ASC, updated_at DESC NULLS LAST
+        LIMIT $${params.length}`,
+      params
+    );
+    return res.rows.map(toRecord);
+  }
   async listSources(recordId) {
     const res = await this.client.query(
       `SELECT sources FROM mem_records WHERE id = $1`,
@@ -1293,6 +1411,9 @@ var LazyPostgresBackend = class {
   async findBySource(...a) {
     return (await this.ensure()).findBySource(...a);
   }
+  async findByKeys(...a) {
+    return (await this.ensure()).findByKeys(...a);
+  }
   async listSources(...a) {
     return (await this.ensure()).listSources(...a);
   }
@@ -1648,6 +1769,9 @@ var LazyEmbeddedPostgresBackend = class {
   async findBySource(...a) {
     return (await this.ensure()).findBySource(...a);
   }
+  async findByKeys(...a) {
+    return (await this.ensure()).findByKeys(...a);
+  }
   async listSources(...a) {
     return (await this.ensure()).listSources(...a);
   }
@@ -1832,8 +1956,8 @@ async function upsertRecord(input, opts = {}) {
   const { searchable_text, content_hash, embedding, embedding_model } = await prepareRecord(input, opts, "sync");
   const prepared = {
     ...input,
-    searchable_text: input.searchable_text ?? searchable_text,
-    content_hash: input.content_hash ?? content_hash,
+    searchable_text: opts.preserveDerived ? void 0 : input.searchable_text ?? searchable_text,
+    content_hash: opts.preserveDerived ? void 0 : input.content_hash ?? content_hash,
     embedding,
     embedding_model
   };