@withone/cli 1.54.1 → 1.55.1

package/README.md

@@ -587,8 +587,13 @@ Resume a paused or failed workflow run from where it left off.
 
 ```bash
 one flow resume abc123
+one flow resume abc123 --allow-bash    # required if the flow has bash steps
 ```
 
+`--allow-bash` is gated the same way as on `flow execute` — resuming doesn't
+inherit the permission from the original run, so pass it again. `one flow list`
+shows which flows need it.
+
 ### `one flow runs [flowKey]`
 
 List workflow runs, optionally filtered by workflow key.

package/dist/{chunk-XN4ZWMLX.js → chunk-FS4HAKZ6.js}

@@ -523,7 +523,9 @@ async function writePageToMemory(profile, records, opts = {}) {
   const searchablePaths = getSearchablePaths(profile);
   const declaresIdentityKeys = (profile.identityKeys?.length ?? 0) > 0;
   const enrichTimestampField = profile.enrich?.timestampField ?? "_enriched_at";
-  for (const record of records) {
+  for (const rawRecord of records) {
+    const derived = deriveFields(rawRecord, profile.derive);
+    const record = Object.keys(derived).length > 0 ? { ...rawRecord, ...derived } : rawRecord;
     report.attempted++;
     const externalId = getByDotPath(record, profile.idField);
     if (externalId === void 0 || externalId === null || externalId === "") {
@@ -608,6 +610,24 @@ function identityValuesFor(prefix, raw, opts = {}) {
   const v = s.toLowerCase().trim();
   return v ? [v] : [];
 }
+function deriveFields(record, derive) {
+  const out = {};
+  if (!derive) return out;
+  for (const [field, spec] of Object.entries(derive)) {
+    const { path: path5, extract } = typeof spec === "string" ? { path: spec, extract: void 0 } : spec;
+    if (!path5) continue;
+    const values = resolveIdentityPath(record, path5).filter((v) => v !== null && v !== void 0 && typeof v !== "object");
+    if (values.length === 0) continue;
+    if (extract === "email") {
+      const emails = values.flatMap((v) => identityValuesFor("email", v));
+      if (emails.length === 0) continue;
+      out[field] = emails[0];
+      continue;
+    }
+    out[field] = values[0];
+  }
+  return out;
+}
 function tokenizeIdentityPath(path5) {
   const tokens = [];
   const re = /([^.[\]]+)|\[([^\]]*)\]/g;

package/dist/index.js

@@ -66,7 +66,7 @@ import {
   writeDraftProfile,
   writePageToMemory,
   writeProfile
-} from "./chunk-XN4ZWMLX.js";
+} from "./chunk-FS4HAKZ6.js";
 import {
   getByDotPath
 } from "./chunk-44CV5IMX.js";
@@ -150,15 +150,15 @@ import {
 
 // src/cli.ts
 import { createRequire as createRequire3 } from "module";
-import path11 from "path";
+import path12 from "path";
 import { Command } from "commander";
 
 // src/commands/init.ts
 import * as p3 from "@clack/prompts";
 import pc2 from "picocolors";
 import fs3 from "fs";
-import path3 from "path";
-import { fileURLToPath as fileURLToPath2 } from "url";
+import path4 from "path";
+import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/lib/agents.ts
 import fs from "fs";
@@ -649,16 +649,42 @@ import open2 from "open";
 
 // src/lib/skill-sync.ts
 import fs2 from "fs";
-import path2 from "path";
-import { fileURLToPath } from "url";
+import path3 from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/commands/update.ts
-import { createRequire } from "module";
 import { spawn } from "child_process";
 import { readFileSync, writeFileSync, mkdirSync, rmSync } from "fs";
 import { join } from "path";
+
+// src/lib/version.ts
+import { createRequire } from "module";
+import { existsSync } from "fs";
+import path2 from "path";
+import { fileURLToPath } from "url";
 var require2 = createRequire(import.meta.url);
-var { version: currentVersion } = require2("../package.json");
+var cached = null;
+function cliVersion() {
+  if (cached !== null) return cached;
+  const dir = path2.dirname(fileURLToPath(import.meta.url));
+  for (let i = 1; i <= 4; i++) {
+    const candidate = path2.resolve(dir, ...Array(i).fill(".."), "package.json");
+    if (!existsSync(candidate)) continue;
+    try {
+      const version2 = require2(candidate).version;
+      if (version2) {
+        cached = version2;
+        return cached;
+      }
+    } catch {
+    }
+  }
+  cached = "unknown";
+  return cached;
+}
+
+// src/commands/update.ts
+var currentVersion = cliVersion();
 var ONE_DIR = () => join(homeDir(), ".one");
 var CACHE_PATH = () => join(ONE_DIR(), "update-check.json");
 var LOCK_PATH = () => join(ONE_DIR(), "auto-update.lock");
@@ -814,17 +840,17 @@ function autoUpdate(targetVersion, publishedAt) {
 var CANONICAL_SKILL_DIR = ".agents/skills";
 var VERSION_MARKER = ".one-cli-version";
 function getPackagedSkillDir() {
-  const here = path2.dirname(fileURLToPath(import.meta.url));
-  return path2.resolve(here, "..", "skills", "one");
+  const here = path3.dirname(fileURLToPath2(import.meta.url));
+  return path3.resolve(here, "..", "skills", "one");
 }
 function getCanonicalSkillPath() {
-  return path2.join(homeDir(), CANONICAL_SKILL_DIR, "one");
+  return path3.join(homeDir(), CANONICAL_SKILL_DIR, "one");
 }
 function getVersionMarkerPath() {
-  return path2.join(getCanonicalSkillPath(), VERSION_MARKER);
+  return path3.join(getCanonicalSkillPath(), VERSION_MARKER);
 }
 function isSkillInstalled() {
-  return fs2.existsSync(path2.join(getCanonicalSkillPath(), "SKILL.md"));
+  return fs2.existsSync(path3.join(getCanonicalSkillPath(), "SKILL.md"));
 }
 function readInstalledSkillVersion() {
   try {
@@ -844,8 +870,8 @@ function writeInstalledSkillVersion(version2) {
 function copyDirSync(src, dest) {
   fs2.mkdirSync(dest, { recursive: true });
   for (const entry of fs2.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path2.join(src, entry.name);
-    const destPath = path2.join(dest, entry.name);
+    const srcPath = path3.join(src, entry.name);
+    const destPath = path3.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync(srcPath, destPath);
     } else {
@@ -872,7 +898,7 @@ function forceSyncSkills() {
 }
 function performSync(current, reason) {
   const source = getPackagedSkillDir();
-  if (!fs2.existsSync(path2.join(source, "SKILL.md"))) {
+  if (!fs2.existsSync(path3.join(source, "SKILL.md"))) {
     return { synced: false, reason: "source-missing" };
   }
   const canonical = getCanonicalSkillPath();
@@ -1240,7 +1266,7 @@ async function chooseConfigScope(options) {
   const hasGlobal = globalConfigExists();
   const hasProject = projectConfigExists();
   const projectRoot = resolved.projectRoot;
-  const projectName = path3.basename(projectRoot);
+  const projectName = path4.basename(projectRoot);
   const homeGlobal = tildify(getGlobalConfigPath());
   const homeProject = tildify(getProjectConfigPath(projectRoot));
   if (hasProject) {
@@ -1525,26 +1551,26 @@ var SKILL_AGENTS = [
 ];
 var CANONICAL_SKILL_DIR2 = ".agents/skills";
 function getSkillSourceDir() {
-  const __dirname2 = path3.dirname(fileURLToPath2(import.meta.url));
-  return path3.resolve(__dirname2, "..", "skills", "one");
+  const __dirname2 = path4.dirname(fileURLToPath3(import.meta.url));
+  return path4.resolve(__dirname2, "..", "skills", "one");
 }
 function getCanonicalSkillPath2() {
-  return path3.join(homeDir(), CANONICAL_SKILL_DIR2, "one");
+  return path4.join(homeDir(), CANONICAL_SKILL_DIR2, "one");
 }
 function getAgentSkillPath(agent) {
-  return path3.join(homeDir(), agent.skillDir, "one");
+  return path4.join(homeDir(), agent.skillDir, "one");
 }
 function isSkillInstalled2() {
-  return fs3.existsSync(path3.join(getCanonicalSkillPath2(), "SKILL.md"));
+  return fs3.existsSync(path4.join(getCanonicalSkillPath2(), "SKILL.md"));
 }
 function isSkillInstalledForAgent(agent) {
-  return fs3.existsSync(path3.join(getAgentSkillPath(agent), "SKILL.md"));
+  return fs3.existsSync(path4.join(getAgentSkillPath(agent), "SKILL.md"));
 }
 function copyDirSync2(src, dest) {
   fs3.mkdirSync(dest, { recursive: true });
   for (const entry of fs3.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path3.join(src, entry.name);
-    const destPath = path3.join(dest, entry.name);
+    const srcPath = path4.join(src, entry.name);
+    const destPath = path4.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync2(srcPath, destPath);
     } else {
@@ -1557,7 +1583,7 @@ function installSkillForAgents(agentIds) {
   const canonical = getCanonicalSkillPath2();
   const installed = [];
   const failed = [];
-  if (!fs3.existsSync(path3.join(source, "SKILL.md"))) {
+  if (!fs3.existsSync(path4.join(source, "SKILL.md"))) {
     return { installed: [], failed: ["skill source not found"] };
   }
   try {
@@ -1579,14 +1605,14 @@ function installSkillForAgents(agentIds) {
       continue;
     }
     try {
-      const agentSkillsDir = path3.dirname(agentPath);
+      const agentSkillsDir = path4.dirname(agentPath);
       fs3.mkdirSync(agentSkillsDir, { recursive: true });
       try {
         fs3.lstatSync(agentPath);
         fs3.rmSync(agentPath, { recursive: true });
       } catch {
       }
-      const relative = path3.relative(agentSkillsDir, canonical);
+      const relative = path4.relative(agentSkillsDir, canonical);
       fs3.symlinkSync(relative, agentPath);
       installed.push(agent.name);
       seen.set(agentPath, true);
@@ -1833,7 +1859,7 @@ ${whoami.user.name} ${pc2.dim(`(${whoami.user.email})`)}`,
   };
   await promptConnectIntegrations(apiKey, connParams);
   const savedPath = scope === "project" ? getProjectConfigPath() : getGlobalConfigPath();
-  const resolutionHint = scope === "project" ? `When you run ${pc2.cyan("one")} from ${pc2.bold(path3.basename(getProjectRoot()))}, it uses this project config.
+  const resolutionHint = scope === "project" ? `When you run ${pc2.cyan("one")} from ${pc2.bold(path4.basename(getProjectRoot()))}, it uses this project config.
 From anywhere else, it falls back to your global config.` : `This config applies to every folder unless a project config is set.`;
   p3.note(
     `${scopeLabel(scope)} Config saved to:
@@ -2523,11 +2549,11 @@ async function actionsSearchCommand(platform, query, options) {
     const useCache = options.cache !== false;
     const searchType = agentType || "knowledge";
     const cachePath = searchCachePath(platform, query, searchType);
-    const cached = useCache ? readCache(cachePath) : null;
+    const cached2 = useCache ? readCache(cachePath) : null;
     let cleanedActions;
     let cacheHit = false;
-    if (cached && isFresh(cached)) {
-      cleanedActions = cached.data.actions;
+    if (cached2 && isFresh(cached2)) {
+      cleanedActions = cached2.data.actions;
       cacheHit = true;
     } else {
       try {
@@ -2535,12 +2561,12 @@ async function actionsSearchCommand(platform, query, options) {
           platform,
           query,
           agentType,
-          cached?.etag ?? void 0
+          cached2?.etag ?? void 0
         );
-        if (result.status === 304 && cached) {
-          cached.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-          writeCache(cachePath, cached);
-          cleanedActions = cached.data.actions;
+        if (result.status === 304 && cached2) {
+          cached2.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
+          writeCache(cachePath, cached2);
+          cleanedActions = cached2.data.actions;
           cacheHit = true;
         } else {
           let actions2 = result.data;
@@ -2559,12 +2585,12 @@ async function actionsSearchCommand(platform, query, options) {
           ));
         }
       } catch (fetchError) {
-        if (cached) {
+        if (cached2) {
           process.stderr.write(
-            `Warning: serving cached search results (network unavailable, cached ${formatAge(getAge(cached))} ago)
+            `Warning: serving cached search results (network unavailable, cached ${formatAge(getAge(cached2))} ago)
 `
           );
-          cleanedActions = cached.data.actions;
+          cleanedActions = cached2.data.actions;
           cacheHit = true;
         } else {
           throw fetchError;
@@ -2573,8 +2599,8 @@ async function actionsSearchCommand(platform, query, options) {
     }
     if (isAgentMode()) {
       const response = { actions: cleanedActions };
-      if (cacheHit && cached) {
-        response._cache = buildCacheMeta(cached, true);
+      if (cacheHit && cached2) {
+        response._cache = buildCacheMeta(cached2, true);
       } else {
         const freshEntry = readCache(cachePath);
         response._cache = buildCacheMeta(freshEntry, false);
@@ -3196,7 +3222,7 @@ import pc7 from "picocolors";
 
 // src/lib/flow-validator.ts
 import fs4 from "fs";
-import path4 from "path";
+import path5 from "path";
 import { spawnSync } from "child_process";
 function validateFlowSchema(flow2) {
   const errors = [];
@@ -3271,32 +3297,32 @@ function validateStepsArray(steps, pathPrefix, errors) {
   const validTypes = FLOW_SCHEMA.stepTypes.map((st) => st.type);
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
-    const path12 = `${pathPrefix}[${i}]`;
+    const path13 = `${pathPrefix}[${i}]`;
     if (!step || typeof step !== "object" || Array.isArray(step)) {
-      errors.push({ path: path12, message: "Step must be an object" });
+      errors.push({ path: path13, message: "Step must be an object" });
       continue;
     }
     const s = step;
     if (!s.id || typeof s.id !== "string") {
-      errors.push({ path: `${path12}.id`, message: 'Step must have a string "id"' });
+      errors.push({ path: `${path13}.id`, message: 'Step must have a string "id"' });
     }
     if (!s.name || typeof s.name !== "string") {
-      errors.push({ path: `${path12}.name`, message: 'Step must have a string "name"' });
+      errors.push({ path: `${path13}.name`, message: 'Step must have a string "name"' });
     }
     if (!s.type || !validTypes.includes(s.type)) {
-      errors.push({ path: `${path12}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
+      errors.push({ path: `${path13}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
       continue;
     }
     if (s.requires !== void 0) {
       if (!Array.isArray(s.requires)) {
-        errors.push({ path: `${path12}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
+        errors.push({ path: `${path13}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
       } else {
         for (let r = 0; r < s.requires.length; r++) {
           const sel = s.requires[r];
           if (typeof sel !== "string") {
-            errors.push({ path: `${path12}.requires[${r}]`, message: '"requires" entry must be a selector string' });
+            errors.push({ path: `${path13}.requires[${r}]`, message: '"requires" entry must be a selector string' });
           } else if (!sel.startsWith("$.")) {
-            errors.push({ path: `${path12}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
+            errors.push({ path: `${path13}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
           }
         }
       }
@@ -3304,7 +3330,7 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (s.onError && typeof s.onError === "object") {
       const oe = s.onError;
       if (!FLOW_SCHEMA.errorStrategies.includes(oe.strategy)) {
-        errors.push({ path: `${path12}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
+        errors.push({ path: `${path13}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
       }
     }
     const descriptor = getStepTypeDescriptor(s.type);
@@ -3314,14 +3340,14 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (!configObj || typeof configObj !== "object") {
       const hint = detectFlatConfigHint(s, descriptor);
       errors.push({
-        path: `${path12}.${configKey}`,
+        path: `${path13}.${configKey}`,
         message: `${capitalize(descriptor.type)} step must have a "${configKey}" config object${hint}`
       });
       continue;
     }
     const config2 = configObj;
     for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
-      const fieldPath = `${path12}.${configKey}.${fieldName}`;
+      const fieldPath = `${path13}.${configKey}.${fieldName}`;
       const value = config2[fieldName];
       if (fd.required && (value === void 0 || value === null || value === "")) {
         errors.push({ path: fieldPath, message: `${capitalize(descriptor.type)} must have ${fd.type === "string" ? "a string" : fd.type === "array" ? "a" : "a"} "${fieldName}"` });
@@ -3354,30 +3380,30 @@ function validateStepsArray(steps, pathPrefix, errors) {
       }
     }
     if (descriptor.type === "action") {
-      validateConnectionForm(config2, `${path12}.${configKey}`, errors);
+      validateConnectionForm(config2, `${path13}.${configKey}`, errors);
     }
     if (descriptor.type === "code") {
       const hasSource = typeof config2.source === "string" && config2.source.length > 0;
       const hasModule = typeof config2.module === "string" && config2.module.length > 0;
       if (!hasSource && !hasModule) {
-        errors.push({ path: `${path12}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
+        errors.push({ path: `${path13}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
       } else if (hasSource && hasModule) {
-        errors.push({ path: `${path12}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
+        errors.push({ path: `${path13}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
       }
       if (hasModule) {
         const m = config2.module;
         if (m.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(m)) {
-          errors.push({ path: `${path12}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
+          errors.push({ path: `${path13}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
         } else if (m.split(/[\\/]/).includes("..")) {
-          errors.push({ path: `${path12}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
+          errors.push({ path: `${path13}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
         } else if (!m.endsWith(".mjs")) {
-          errors.push({ path: `${path12}.${configKey}.module`, message: "Code module must be a .mjs file" });
+          errors.push({ path: `${path13}.${configKey}.module`, message: "Code module must be a .mjs file" });
         }
       }
       if (hasSource) {
         const syntaxError = checkCodeSourceSyntax(config2.source);
         if (syntaxError) {
-          errors.push({ path: `${path12}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
+          errors.push({ path: `${path13}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
         }
       }
     }
@@ -3449,16 +3475,16 @@ function validateStepIds(flow2) {
   function collectIds(steps, pathPrefix) {
     for (let i = 0; i < steps.length; i++) {
       const step = steps[i];
-      const path12 = `${pathPrefix}[${i}]`;
+      const path13 = `${pathPrefix}[${i}]`;
       if (seen.has(step.id)) {
-        errors.push({ path: `${path12}.id`, message: `Duplicate step ID: "${step.id}"` });
+        errors.push({ path: `${path13}.id`, message: `Duplicate step ID: "${step.id}"` });
       } else {
         seen.add(step.id);
       }
       for (const { configKey, fieldName } of nestedKeys) {
         const config2 = step[configKey];
         if (config2 && Array.isArray(config2[fieldName])) {
-          collectIds(config2[fieldName], `${path12}.${configKey}.${fieldName}`);
+          collectIds(config2[fieldName], `${path13}.${configKey}.${fieldName}`);
         }
       }
     }
@@ -3506,7 +3532,7 @@ function validateSelectorReferences(flow2, rootDir) {
     }
     return selectors;
   }
-  function checkSelectors(selectors, path12, precedingStepIds) {
+  function checkSelectors(selectors, path13, precedingStepIds) {
     for (const selector of selectors) {
       const parts = selector.split(".");
       if (parts.length < 3) continue;
@@ -3514,15 +3540,15 @@ function validateSelectorReferences(flow2, rootDir) {
       if (root === "input") {
         const inputName = parts[2];
         if (!inputNames.has(inputName)) {
-          errors.push({ path: path12, message: `Selector "${selector}" references undefined input "${inputName}"` });
+          errors.push({ path: path13, message: `Selector "${selector}" references undefined input "${inputName}"` });
         }
       } else if (root === "steps") {
         const stepId = parts[2].replace(/[\[\]]/g, "").split(/[\[\]]/)[0];
         if (!allStepIds.has(stepId)) {
-          errors.push({ path: path12, message: `Selector "${selector}" references undefined step "${stepId}"` });
+          errors.push({ path: path13, message: `Selector "${selector}" references undefined step "${stepId}"` });
         } else if (precedingStepIds && !precedingStepIds.has(stepId)) {
           errors.push({
-            path: path12,
+            path: path13,
             message: `Selector "${selector}" references step "${stepId}" which is declared after the current step. Steps execute in declaration order, so this will always resolve to undefined at runtime \u2014 move the dependency earlier in the steps array.`
           });
         }
@@ -3530,20 +3556,20 @@ function validateSelectorReferences(flow2, rootDir) {
     }
   }
   const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
-  function checkOperatorsInSelectorField(value, path12) {
+  function checkOperatorsInSelectorField(value, path13) {
     if (typeof value === "string" && value.startsWith("$.")) {
       if (value.includes("||")) {
-        errors.push({ path: path12, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+        errors.push({ path: path13, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
       } else if (value.includes("&&")) {
-        errors.push({ path: path12, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+        errors.push({ path: path13, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
       }
     } else if (value && typeof value === "object" && !Array.isArray(value)) {
       for (const [k, v] of Object.entries(value)) {
-        checkOperatorsInSelectorField(v, `${path12}.${k}`);
+        checkOperatorsInSelectorField(v, `${path13}.${k}`);
       }
     } else if (Array.isArray(value)) {
       for (let i = 0; i < value.length; i++) {
-        checkOperatorsInSelectorField(value[i], `${path12}[${i}]`);
+        checkOperatorsInSelectorField(value[i], `${path13}[${i}]`);
       }
     }
   }
@@ -3587,7 +3613,7 @@ function validateSelectorReferences(flow2, rootDir) {
           }
           const modulePath = step.type === "code" ? c.module : void 0;
           if (rootDir && typeof modulePath === "string" && modulePath.length > 0) {
-            const abs = path4.resolve(rootDir, modulePath);
+            const abs = path5.resolve(rootDir, modulePath);
             if (fs4.existsSync(abs)) {
               try {
                 const moduleText = fs4.readFileSync(abs, "utf-8");
@@ -3628,10 +3654,10 @@ var VALID_OUTPUT_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "bo
 function isOutputSchemaObject(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function walkOutputSchema(schema, path12) {
+function walkOutputSchema(schema, path13) {
   let current = schema;
-  for (let i = 0; i < path12.length; i++) {
-    const seg = path12[i];
+  for (let i = 0; i < path13.length; i++) {
+    const seg = path13[i];
     if (typeof current === "string") {
       return current === "unknown" || current === "object" || current === "array" ? "opaque" : "opaque";
     }
@@ -3783,7 +3809,7 @@ function validateCodeModules(flow2, rootDir) {
       const stepPath = `${pathPrefix}[${i}]`;
       if (step.type === "code" && step.code?.module) {
         const m = step.code.module;
-        const abs = path4.resolve(rootDir, m);
+        const abs = path5.resolve(rootDir, m);
         if (!fs4.existsSync(abs)) {
           errors.push({
             path: `${stepPath}.code.module`,
@@ -3916,9 +3942,9 @@ function validateFileReadSchemas(flow2) {
 
 // src/commands/flow.ts
 import fs5 from "fs";
-import path5 from "path";
+import path6 from "path";
 async function writeFlowResultFile(filePath, meta, steps) {
-  const abs = path5.resolve(filePath);
+  const abs = path6.resolve(filePath);
   const ws = fs5.createWriteStream(abs);
   const done = new Promise((resolve, reject) => {
     ws.on("finish", () => resolve());
@@ -4326,7 +4352,7 @@ async function flowValidateCommand(keyOrPath) {
       const flowPath = resolveFlowPath(keyOrPath);
       const content = fs5.readFileSync(flowPath, "utf-8");
       flowData = JSON.parse(content);
-      rootDir = path5.dirname(flowPath);
+      rootDir = path6.dirname(flowPath);
     }
   } catch (err) {
     spinner5.stop("Validation failed");
@@ -4353,7 +4379,7 @@ async function flowValidateCommand(keyOrPath) {
   }
   note(`Workflow "${flowData.key}" passed all validation checks`, "Valid");
 }
-async function flowResumeCommand(runId) {
+async function flowResumeCommand(runId, options = {}) {
   intro(pc7.bgCyan(pc7.black(" One Workflow ")));
   const state = FlowRunner.loadRunState(runId);
   if (!state) {
@@ -4374,6 +4400,14 @@ async function flowResumeCommand(runId) {
     error(`Could not load workflow "${state.flowKey}": ${err instanceof Error ? err.message : String(err)}`);
     return;
   }
+  if (!options.allowBash && flowRequiresBash(flow2)) {
+    const msg = `Workflow "${flow2.key}" contains bash steps. Re-run with --allow-bash to permit shell execution.`;
+    if (isAgentMode()) {
+      json({ error: msg, requiresBash: true, flowKey: flow2.key, runId });
+      process.exit(1);
+    }
+    error(msg);
+  }
   const runner = FlowRunner.fromRunState(state);
   const onEvent = (event) => {
     if (isAgentMode()) {
@@ -4383,7 +4417,11 @@ async function flowResumeCommand(runId) {
   const spinner5 = createSpinner();
   spinner5.start(`Resuming run ${runId} (${state.completedSteps.length} steps already completed)...`);
   try {
-    const context = await runner.resume(flow2, api, permissions, actionIds, { onEvent, rootDir });
+    const context = await runner.resume(flow2, api, permissions, actionIds, {
+      onEvent,
+      rootDir,
+      allowBash: options.allowBash
+    });
     spinner5.stop("Workflow completed");
     if (isAgentMode()) {
       json({
@@ -4502,7 +4540,7 @@ async function flowInspectCommand(runId, options = {}) {
   }
   console.log();
   console.log(`  ${pc7.dim(`State: ${statePath}`)}`);
-  console.log(`  ${pc7.dim(`Log:   ${path5.join(".one/flows/.logs", `${state.flowKey}-${state.runId}.log`)}`)}`);
+  console.log(`  ${pc7.dim(`Log:   ${path6.join(".one/flows/.logs", `${state.flowKey}-${state.runId}.log`)}`)}`);
   console.log();
 }
 function colorStatus(status) {
@@ -5208,10 +5246,10 @@ function handleId(response, config2, records) {
 
 // src/lib/memory/sync/state.ts
 import fs6 from "fs";
-import path6 from "path";
-var SYNC_DIR = path6.join(".one", "sync");
-var STATE_DIR = path6.join(SYNC_DIR, "state");
-var LEGACY_SINGLE_FILE = path6.join(SYNC_DIR, "sync_state.json");
+import path7 from "path";
+var SYNC_DIR = path7.join(".one", "sync");
+var STATE_DIR = path7.join(SYNC_DIR, "state");
+var LEGACY_SINGLE_FILE = path7.join(SYNC_DIR, "sync_state.json");
 var legacyMigrationDone = false;
 function rowToState(row) {
   return {
@@ -5264,7 +5302,7 @@ async function migrateLegacyOnce() {
       const backend = await getBackend();
       const platforms = fs6.readdirSync(STATE_DIR);
       for (const platform of platforms) {
-        const platformDir = path6.join(STATE_DIR, platform);
+        const platformDir = path7.join(STATE_DIR, platform);
         let entries;
         try {
           entries = fs6.readdirSync(platformDir);
@@ -5274,7 +5312,7 @@ async function migrateLegacyOnce() {
         for (const entry of entries) {
           if (!entry.endsWith(".json")) continue;
           const model = entry.slice(0, -".json".length);
-          const filePath = path6.join(platformDir, entry);
+          const filePath = path7.join(platformDir, entry);
           try {
             const raw = fs6.readFileSync(filePath, "utf-8");
             const modelState = JSON.parse(raw);
@@ -5331,11 +5369,11 @@ async function removeModelState(platform, model) {
 
 // src/lib/memory/sync/lock.ts
 import fs7 from "fs";
-import path7 from "path";
-var LOCK_DIR_REL = path7.join(".one", "sync", "locks");
+import path8 from "path";
+var LOCK_DIR_REL = path8.join(".one", "sync", "locks");
 var STALE_MS = 30 * 60 * 1e3;
 function lockPath(platform, model) {
-  return path7.join(LOCK_DIR_REL, `${platform}_${model}`);
+  return path8.join(LOCK_DIR_REL, `${platform}_${model}`);
 }
 function isProcessAlive(pid) {
   try {
@@ -5354,7 +5392,7 @@ var SyncLockError = class extends Error {
 function acquireSyncLock(platform, model) {
   fs7.mkdirSync(LOCK_DIR_REL, { recursive: true });
   const dir = lockPath(platform, model);
-  const pidFile = path7.join(dir, "pid");
+  const pidFile = path8.join(dir, "pid");
   try {
     fs7.mkdirSync(dir);
   } catch (err) {
@@ -5412,8 +5450,8 @@ function acquireSyncLock(platform, model) {
 // src/lib/memory/sync/hooks.ts
 import { spawn as spawn2 } from "child_process";
 import fs8 from "fs";
-import path8 from "path";
-var EVENTS_DIR = path8.join(".one", "sync", "events");
+import path9 from "path";
+var EVENTS_DIR = path9.join(".one", "sync", "events");
 function classifyRecords(db, model, records, idField, tableExists2) {
   if (!tableExists2 || records.length === 0) {
     return { inserts: records, updates: [] };
@@ -5460,7 +5498,7 @@ function appendEventLog(events) {
   if (events.length === 0) return;
   const { platform, model } = events[0];
   fs8.mkdirSync(EVENTS_DIR, { recursive: true });
-  const logPath = path8.join(EVENTS_DIR, `${platform}_${model}.jsonl`);
+  const logPath = path9.join(EVENTS_DIR, `${platform}_${model}.jsonl`);
   const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
   fs8.appendFileSync(logPath, lines);
 }
@@ -5566,8 +5604,8 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function interpolate(template, record) {
-  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path12) => {
-    const parts = path12.split(".");
+  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path13) => {
+    const parts = path13.split(".");
     let value = record;
     for (const part of parts) {
       if (typeof value !== "object" || value === null) return "";
@@ -5595,8 +5633,8 @@ function deepMerge(target, source) {
   }
   return result;
 }
-function getByDotPath2(obj, path12) {
-  const parts = path12.split(".");
+function getByDotPath2(obj, path13) {
+  const parts = path13.split(".");
   let current = obj;
   for (const part of parts) {
     if (current === null || current === void 0 || typeof current !== "object") return void 0;
@@ -5605,8 +5643,8 @@ function getByDotPath2(obj, path12) {
   return current;
 }
 function stripExcludedFields(obj, paths) {
-  for (const path12 of paths) {
-    stripOnePath(obj, path12.replace(/\[\]/g, ".*").split("."));
+  for (const path13 of paths) {
+    stripOnePath(obj, path13.replace(/\[\]/g, ".*").split("."));
   }
 }
 function stripOnePath(obj, parts) {
@@ -5888,6 +5926,21 @@ async function enrichPhase(api, db, config2, model, idField, connectionKey, plat
   const duration = elapsed < 1e3 ? `${elapsed}ms` : elapsed < 6e4 ? `${(elapsed / 1e3).toFixed(1)}s` : `${Math.floor(elapsed / 6e4)}m ${Math.floor(elapsed % 6e4 / 1e3)}s`;
   return { enriched, skipped, rateLimited, total, duration };
 }
+async function enrichOneForPreview(api, profile, record, connectionKey) {
+  const config2 = profile.enrich;
+  if (!config2) return null;
+  try {
+    const detailAction = (await resolveActionDetails(api, config2.actionId)).details;
+    const detail = await enrichSingleRow(api, detailAction, config2, record, connectionKey, profile.platform);
+    if (!detail) return null;
+    let enrichedData = detail;
+    if (config2.fields && config2.fields.length > 0) enrichedData = pickFields(enrichedData, config2.fields);
+    if (config2.exclude && config2.exclude.length > 0) stripExcludedFields(enrichedData, config2.exclude);
+    return config2.merge !== false ? deepMerge(record, enrichedData) : { ...enrichedData, [profile.idField]: record[profile.idField] };
+  } catch {
+    return null;
+  }
+}
 async function enrichSingleRow(api, detailAction, config2, row, connectionKey, platform) {
   const pathVars = interpolateParams(config2.pathVars, row);
   const queryParams = interpolateParams(config2.queryParams, row);
@@ -6012,8 +6065,8 @@ function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function stripFields(record, paths) {
-  for (const path12 of paths) {
-    stripOnePath2(record, path12.split("."));
+  for (const path13 of paths) {
+    stripOnePath2(record, path13.split("."));
   }
 }
 function stripOnePath2(obj, parts) {
@@ -6879,7 +6932,14 @@ async function testSyncProfile(api, profile) {
   }));
   report.sample = first;
   report.samples = records.slice(0, SEARCHABLE_SAMPLE_SIZE);
-  report.identityKeysPreview = buildIdentityKeysPreview(report.samples, profile);
+  if (profile.enrich && (profile.identityKeys?.length ?? 0) > 0 && report.samples.length > 0) {
+    const merged = await enrichOneForPreview(api, profile, report.samples[0], connectionKey);
+    if (merged) {
+      const preview = buildIdentityKeysPreview([merged], profile);
+      if (preview) report.identityKeysPreview = { ...preview, previewedAfterEnrich: true };
+    }
+  }
+  report.identityKeysPreview ??= buildIdentityKeysPreview(report.samples, profile);
   report.ok = checks.every((c) => c.ok);
   return report;
 }
@@ -7101,13 +7161,13 @@ function inferProfileFromKnowledge(knowledge, modelName, platform) {
 import { spawnSync as spawnSync2 } from "child_process";
 import fs10 from "fs";
 import os from "os";
-import path10 from "path";
+import path11 from "path";
 
 // src/lib/memory/sync/schedule-registry.ts
 import fs9 from "fs";
-import path9 from "path";
-var REGISTRY_DIR = () => path9.join(homeDir(), ".one", "sync");
-var REGISTRY_FILE = () => path9.join(REGISTRY_DIR(), "schedules.json");
+import path10 from "path";
+var REGISTRY_DIR = () => path10.join(homeDir(), ".one", "sync");
+var REGISTRY_FILE = () => path10.join(REGISTRY_DIR(), "schedules.json");
 function readRaw() {
   try {
     if (!fs9.existsSync(REGISTRY_FILE())) return { schedules: [] };
@@ -7126,7 +7186,7 @@ function writeRaw(file) {
   fs9.renameSync(tmp, REGISTRY_FILE());
 }
 function makeScheduleId(platform, cwd) {
-  const slug = path9.basename(cwd).replace(/[^a-zA-Z0-9_-]/g, "-").toLowerCase();
+  const slug = path10.basename(cwd).replace(/[^a-zA-Z0-9_-]/g, "-").toLowerCase();
   return `${platform}-${slug}`;
 }
 function listRegistered() {
@@ -7160,7 +7220,7 @@ function removeRegistered(id) {
 
 // src/lib/memory/sync/schedule.ts
 var MARKER = "# one-sync";
-var LOG_DIR_REL = path10.join(".one", "sync", "logs");
+var LOG_DIR_REL = path11.join(".one", "sync", "logs");
 function durationToCron(every) {
   const match = every.match(/^(\d+)([mhd])$/);
   if (!match) return null;
@@ -7277,7 +7337,7 @@ function migrateLegacyCronEntries() {
     const modelsMatch = command.match(/--models\s+(\S+)/);
     const models = modelsMatch ? modelsMatch[1].split(",") : void 0;
     const logMatch = command.match(/>>\s+"([^"]+)"/);
-    const logFile = logMatch ? logMatch[1] : path10.resolve(cwd, LOG_DIR_REL, `${platform}.log`);
+    const logFile = logMatch ? logMatch[1] : path11.resolve(cwd, LOG_DIR_REL, `${platform}.log`);
     const id = makeScheduleId(platform, cwd);
     if (registeredIds.has(id)) continue;
     upsertRegistered({
@@ -7311,9 +7371,9 @@ function addSchedule(opts) {
   const cwd = process.cwd();
   const id = makeScheduleId(opts.platform, cwd);
   const replaced = getRegistered(id) !== void 0;
-  const logDir = path10.join(cwd, LOG_DIR_REL);
+  const logDir = path11.join(cwd, LOG_DIR_REL);
   fs10.mkdirSync(logDir, { recursive: true });
-  const logFile = path10.join(logDir, `${opts.platform}.log`);
+  const logFile = path11.join(logDir, `${opts.platform}.log`);
   const entry = {
     id,
     platform: opts.platform,
@@ -7657,11 +7717,11 @@ function isNoise(s) {
   if (/^-?\d+(\.\d+)?([eE][-+]?\d+)?$/.test(s)) return true;
   return false;
 }
-function recordSample(stats, path12, value, jsType, recordIndex, totalSamples) {
-  let s = stats.get(path12);
+function recordSample(stats, path13, value, jsType, recordIndex, totalSamples) {
+  let s = stats.get(path13);
   if (!s) {
     s = {
-      path: path12,
+      path: path13,
       total: totalSamples,
       recordIndices: /* @__PURE__ */ new Set(),
       lenSum: 0,
@@ -7670,7 +7730,7 @@ function recordSample(stats, path12, value, jsType, recordIndex, totalSamples) {
       primaryType: jsType,
       examples: []
     };
-    stats.set(path12, s);
+    stats.set(path13, s);
   }
   s.recordIndices.add(recordIndex);
   s.lenSum += value.length;
@@ -7679,28 +7739,28 @@ function recordSample(stats, path12, value, jsType, recordIndex, totalSamples) {
   if (s.primaryType !== jsType) s.primaryType = "mixed";
   if (s.examples.length < 3 && value.length < 200) s.examples.push(value);
 }
-function walkRecord(record, path12, stats, recordIndex, totalSamples) {
+function walkRecord(record, path13, stats, recordIndex, totalSamples) {
   if (record === null || record === void 0) return;
   if (typeof record === "string") {
     const trimmed = record.trim();
-    if (trimmed) recordSample(stats, path12, trimmed, "string", recordIndex, totalSamples);
+    if (trimmed) recordSample(stats, path13, trimmed, "string", recordIndex, totalSamples);
     return;
   }
   if (typeof record === "number" || typeof record === "boolean") {
     const str = String(record);
     const kind = typeof record === "number" ? "number" : "boolean";
-    if (str) recordSample(stats, path12, str, kind, recordIndex, totalSamples);
+    if (str) recordSample(stats, path13, str, kind, recordIndex, totalSamples);
     return;
   }
   if (Array.isArray(record)) {
-    const childPath = path12 ? `${path12}[]` : "[]";
+    const childPath = path13 ? `${path13}[]` : "[]";
     for (const item of record) walkRecord(item, childPath, stats, recordIndex, totalSamples);
     return;
   }
   if (typeof record === "object") {
     for (const [key, value] of Object.entries(record)) {
       if (key.startsWith("_")) continue;
-      const childPath = path12 ? `${path12}.${key}` : key;
+      const childPath = path13 ? `${path13}.${key}` : key;
       walkRecord(value, childPath, stats, recordIndex, totalSamples);
     }
   }
@@ -8135,7 +8195,7 @@ function buildSearchablePreview(profile, samples) {
   const first = samples[0];
   const paths = getSearchablePaths(profile);
   if (paths) {
-    const perPathAgg = paths.map((path12) => ({ path: path12, hits: 0, total: samples.length, sample: "" }));
+    const perPathAgg = paths.map((path13) => ({ path: path13, hits: 0, total: samples.length, sample: "" }));
     for (const record of samples) {
       const { paths: perPath } = extractSearchableFromPaths(record, paths);
       perPath.forEach((p10, i) => {
@@ -8379,7 +8439,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
       `  detected legacy .one/sync/data/${platform}.db (${dbSize}) \u2014 auto-migrating into memory before sync.
 `
     );
-    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-UGDDHWGY.js");
+    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-37A463L6.js");
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
@@ -8388,7 +8448,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
     initialValue: true
   });
   if (p7.isCancel(shouldMigrate) || !shouldMigrate) return;
-  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-UGDDHWGY.js");
+  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-37A463L6.js");
   await memMigrateCommand2({ platform, yes: true });
 }
 async function syncSuggestSearchableCommand(platformModel, options = {}) {
@@ -9092,16 +9152,16 @@ function projectEmbeddingApiKey(cfg) {
 }
 function redactSecrets(cfg) {
   const copy = JSON.parse(JSON.stringify(cfg));
-  for (const path12 of SECRET_PATHS) {
-    const val = getPath(copy, path12);
+  for (const path13 of SECRET_PATHS) {
+    const val = getPath(copy, path13);
     if (typeof val === "string" && val.length > 0) {
-      setPath(copy, path12, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
+      setPath(copy, path13, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
     }
   }
   return copy;
 }
-function getPath(obj, path12) {
-  const parts = path12.split(".");
+function getPath(obj, path13) {
+  const parts = path13.split(".");
   let cur = obj;
   for (const part of parts) {
     if (cur == null || typeof cur !== "object") return void 0;
@@ -9109,8 +9169,8 @@ function getPath(obj, path12) {
   }
   return cur;
 }
-function setPath(obj, path12, value) {
-  const parts = path12.split(".");
+function setPath(obj, path13, value) {
+  const parts = path13.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
@@ -9120,8 +9180,8 @@ function setPath(obj, path12, value) {
   cur[parts[parts.length - 1]] = value;
   return obj;
 }
-function unsetPath(obj, path12) {
-  const parts = path12.split(".");
+function unsetPath(obj, path13) {
+  const parts = path13.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
@@ -10859,6 +10919,30 @@ Enrichment runs after list sync completes (Phase 2), not inline. It's inherently
 
 **Limitation:** Each profile supports one enrich action. If you need multiple enrichments (e.g. both summary and transcript from Fathom), create a second profile/model for the second enrichment.
 
+## Derived fields (\`derive\`)
+
+Add flat, queryable top-level fields computed from paths already in the record \u2014 no shell, no \`jq\`:
+
+\`\`\`json
+{
+  "derive": {
+    "from_email": {
+      "path": "messages[0].payload.headers[name=From].value",
+      "extract": "email"
+    },
+    "company": "organization.name"
+  }
+}
+\`\`\`
+
+- Paths use the same resolver as \`identityKeys\`, so \`[]\` wildcards, \`[0]\` indexes and \`[name=From]\` filters all work
+- \`extract: "email"\` pulls the address out of a display-name header (\`"Jane <jane@acme.com>"\` \u2192 \`jane@acme.com\`), lowercased
+- A path resolving to nothing **omits** the field rather than writing null, so \`--where\` filters behave
+- A path resolving to several values takes the first \u2014 it's a flat field by definition, and the path syntax lets you be specific
+- Applied on both sync phases, so an enriching profile gets the same field whether the record came from the list or the detail pass
+
+**Prefer \`derive\` over \`transform\` for extracting a field.** \`transform\` spawns \`sh -c\`, so it needs \`jq\` (or whatever you invoke) on PATH and does nothing on Windows. \`derive\` is pure and works everywhere \u2014 which is why the built-in \`gmail/gmailThreads\` profile uses it for \`from_email\`. Reach for \`transform\` when you need real computation, not field extraction.
+
 ## Record Transform
 
 Pipe records through any shell command or flow between fetch and store. The command receives a JSON array on stdin and must return a JSON array on stdout.
@@ -10933,7 +11017,9 @@ Two ways to tag a record with a cross-platform identifier (e.g. email), dependin
 ]}
 \`\`\`
 
-Each \`path\` supports \`[]\` wildcards (one key per element) and a \`[name=From]\` equality filter (e.g. Gmail \`messages[].payload.headers[name=From].value\`). \`email\`-prefixed values are email-extracted, so display-name headers (\`"Jane <jane@acme.com>"\`) and comma-lists normalize cleanly. Values are lowercased/trimmed/deduped. \`sync test\` previews how many identity keys each record resolves.
+Each \`path\` supports \`[]\` wildcards (one key per element) and a \`[name=From]\` equality filter (e.g. Gmail \`messages[].payload.headers[name=From].value\`). \`email\`-prefixed values are email-extracted, so display-name headers (\`"Jane <jane@acme.com>"\`) and comma-lists normalize cleanly. Values are lowercased/trimmed/deduped.
+
+\`sync test\` previews how many identity keys each record resolves. For an **enriching** profile the participant paths live in the detail payload, so \`sync test\` spends one detail call on the first sample and previews against the merged shape \u2014 you see the keys a real sync would write, not zero plus a promise. If that call can't be made (rate limit, permissions), it falls back to the list-shape preview and says the keys resolve after enrichment.
 
 The built-in \`gmail/gmailThreads\` profile collects From/To/**Cc/Bcc**. Gmail only returns a \`Bcc\` header on messages the authenticated user sent \u2014 it is stripped for recipients \u2014 so Bcc keys appear on your own sent threads and nowhere else.
 
@@ -11586,13 +11672,6 @@ function posthogHost() {
 function posthogKey() {
   return process.env.ONE_POSTHOG_KEY || DEFAULT_POSTHOG_KEY;
 }
-function cliVersion() {
-  try {
-    return require3("../package.json").version;
-  } catch {
-    return "unknown";
-  }
-}
 function envName() {
   const key = getApiKey();
   return key ? getEnvFromApiKey(key) : "live";
@@ -12065,11 +12144,11 @@ config.command("reset").description("Remove the project config for the current d
   const configContent = fs13.readFileSync(resolved.path, "utf-8");
   fs13.unlinkSync(resolved.path);
   const next = resolveConfig();
-  fs13.mkdirSync(path11.dirname(resolved.path), { recursive: true });
+  fs13.mkdirSync(path12.dirname(resolved.path), { recursive: true });
   fs13.writeFileSync(resolved.path, configContent);
   let fallbackLabel;
   if (next.scope === "project") {
-    fallbackLabel = `parent project config (${path11.basename(next.projectRoot)})`;
+    fallbackLabel = `parent project config (${path12.basename(next.projectRoot)})`;
   } else if (next.scope === "global") {
     fallbackLabel = "global config";
   } else {
@@ -12078,7 +12157,7 @@ config.command("reset").description("Remove the project config for the current d
   if (!isAgentMode()) {
     const p10 = await import("@clack/prompts");
     const confirmed = await p10.confirm({
-      message: `Delete project config for ${path11.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
+      message: `Delete project config for ${path12.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
       initialValue: false
     });
     if (p10.isCancel(confirmed) || !confirmed) {
@@ -12088,7 +12167,7 @@ config.command("reset").description("Remove the project config for the current d
   }
   fs13.unlinkSync(resolved.path);
   try {
-    fs13.rmdirSync(path11.dirname(resolved.path));
+    fs13.rmdirSync(path12.dirname(resolved.path));
   } catch {
   }
   if (isAgentMode()) {
@@ -12152,8 +12231,8 @@ flow.command("list").alias("ls").description("List all workflows in .one/flows/"
 flow.command("validate <keyOrPath>").description("Validate a workflow JSON file").action(async (keyOrPath) => {
   await flowValidateCommand(keyOrPath);
 });
-flow.command("resume <runId>").description("Resume a paused or failed workflow run").action(async (runId) => {
-  await flowResumeCommand(runId);
+flow.command("resume <runId>").description("Resume a paused or failed workflow run").option("--allow-bash", "Allow bash step execution (disabled by default for security) \u2014 required to resume any flow containing bash steps").action(async (runId, options) => {
+  await flowResumeCommand(runId, options);
 });
 flow.command("runs [flowKey]").description("List workflow runs (optionally filtered by flow key)").action(async (flowKey) => {
   await flowRunsCommand(flowKey);

package/dist/{migrate-UGDDHWGY.js → migrate-37A463L6.js}

@@ -3,7 +3,7 @@ import {
   dotPathToJsonbExpr,
   memMigrateCommand,
   reviveStringifiedJson
-} from "./chunk-XN4ZWMLX.js";
+} from "./chunk-FS4HAKZ6.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-GNSR3NYN.js";
 import "./chunk-DDCDPVJH.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.54.1",
+  "version": "1.55.1",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/profiles/gmail/gmailThreads.json

@@ -21,6 +21,12 @@
     { "prefix": "email", "path": "messages[].payload.headers[name=Cc].value" },
     { "prefix": "email", "path": "messages[].payload.headers[name=Bcc].value" }
   ],
+  "derive": {
+    "from_email": {
+      "path": "messages[0].payload.headers[name=From].value",
+      "extract": "email"
+    }
+  },
   "enrich": {
     "actionId": "conn_mod_def::GJ3ok0Eq0R8::AAzgZVLqTg2iBuITKpJLZg",
     "pathVars": { "userId": "me", "id": "{id}" },

package/skills/one/SKILL.md

@@ -311,6 +311,8 @@ Without declared paths, the default walker concatenates every string in the reco
 
 **Connections are late-bound** — profiles use `"connection": { "platform": "<name>" }`, not literal `connectionKey` strings. The key is resolved at sync time, so `one add <platform>` (re-auth) doesn't break the profile. For multi-account platforms, add `"tag": "<connection-tag>"` to disambiguate, and create the tagged connection with `one add <platform> --tag <name>`. Don't hardcode connection keys in profiles.
 
+**Extracting a flat field? Use `derive`, not `transform`.** `derive` computes top-level fields from paths already in the record (`"derive": { "from_email": { "path": "messages[0].payload.headers[name=From].value", "extract": "email" } }`), using the same path syntax as `identityKeys`. `transform` spawns `sh -c`, so it needs `jq` on PATH and silently does nothing on Windows — never put one in a profile you intend to share. A path that resolves to nothing omits the field rather than writing null.
+
 **Installed profiles do not auto-update.** `sync run` reads only `.one/sync/profiles/<platform>_<model>.json` and never merges the shipped built-in, so a profile created before a capability shipped silently lacks it — a pre-#167 gmail profile writes zero identity keys, forever, with no change in record counts. `sync run` warns when the built-in declares `identityKeys` / `identityKey` / `enrich` / `dateFilter` / `memory` that your copy lacks (agent mode: a `profileDrift` array). Fix with `one sync init <platform> <model>`, which patches rather than overwrites.
 
 **Cross-platform identity on a profile.** Two separate fields, and picking the wrong one silently mangles data:

package/skills/one/references/flows.md

@@ -686,8 +686,14 @@ one --agent flow execute <key> --allow-bash -i key=value
 one --agent flow runs [flowKey]
 one --agent flow inspect <runId>          # per-step outputs of a past run (add --full for untruncated)
 one --agent flow resume <runId>
+one --agent flow resume <runId> --allow-bash   # required if the flow has bash steps
 ```
 
+`flow resume` gates bash exactly like `flow execute` — the permission is not
+inherited from the original run. Resuming a bash flow without the flag fails
+fast with `{"error": "...", "requiresBash": true, "flowKey": "...", "runId": "..."}`,
+so re-invoke with `--allow-bash` rather than treating it as a broken run.
+
 ## Debugging a flow
 
 Three tools that turn "re-run the whole 40-step flow to debug step 30" into near-zero-cost inspection: