@withone/cli 1.55.3 → 1.56.0

package/README.md

@@ -48,6 +48,8 @@ one login              # Opens browser for authentication (global or per-directo
 one logout             # Clear credentials (with scope picker and confirmation)
 ```
 
+The browser consent page names the key and tags it with where this CLI is installed (scope, project path, machine, OS user, CLI version, chosen harnesses, and the per-install device id unless telemetry is off) so you can find and revoke it from Settings → API keys. The terminal prints exactly what will be sent before the browser opens.
+
 Requires Node.js 18+. `one sync` additionally needs Node 20+, because its
 local SQLite engine (`better-sqlite3`, an optional dependency) ships prebuilt
 binaries only for Node 20 and above. On Node 18 every other command works
@@ -162,6 +164,10 @@ one init --auth manual --api-key sk_live_...   # headless / CI, no browser
 | `--auth <browser\|manual>` | Run setup with **no prompts**. `browser` opens a login window; `manual` uses `--api-key`. Scope from `-g`/`-p` (default global). |
 | `--api-key <key>` | API key for `--auth manual` (`sk_live_…` / `sk_test_…`) |
 | `--openai-key <key>` | Optional OpenAI key for `one mem` semantic search |
+| `ONE_APP_URL` (env) | Dashboard origin the browser flows open (default `https://app.withone.ai`); use `http://localhost:4202` against a local frontend. |
+| `ONE_API_BASE` (env) | API origin, overriding `apiBase` in config (default `https://api.withone.ai`); use `http://localhost:5005` against a local backend. |
+
+Both overrides apply to the current process only and are never written to config, so a key minted against a local backend lands in your normal config and a cron job or MCP server without the variable would send it to the hosted API. Pair them with `ONE_HOME` (see below) to keep a local stack's credentials in a separate profile.
 
 ### `one add <platform>`
 
@@ -650,6 +656,10 @@ Updates the CLI to the latest version (`npm install -g @withone/cli@latest`).
 
 The CLI also **auto-updates in the background**: when a newer version has been published for more than 30 minutes, the next `one` command silently kicks off a global install. This is hardened against concurrent runs — a lock file in `~/.one/` ensures at most one install runs at a time (so parallel agent invocations can't collide and wedge npm), and the lock self-heals after 10 minutes if an install ever crashes or hangs.
 
+**Scheduled runs update too.** `one sync schedule` installs a crontab entry, and cron runs jobs with a bare `PATH=/usr/bin:/bin` — where an nvm, Volta, fnm, or Homebrew `npm` does not appear. The updater therefore resolves `npm` next to the running `node` binary rather than through `PATH`, and prepends node's own directory to the install's environment. Without this a scheduled install can never upgrade itself and stays pinned to the version that created it, forever.
+
+If an install still doesn't land — a read-only prefix, a permissions problem, a node with no npm alongside it — the CLI **says so instead of retrying invisibly**. npm's own output is appended to `~/.one/auto-update.log`, and after three consecutive failed attempts a warning goes to **stderr** (never stdout, so it can't corrupt `--agent` JSON or a piped command) telling you to run the install by hand. That notice repeats at most once a day.
+
 To disable background auto-updates entirely (e.g. on CI or a shared agent host), set:
 
 ```bash

package/dist/{chunk-EVEUGRCB.js → chunk-6UB623BG.js}

@@ -181,10 +181,18 @@ function getAccessControl() {
 }
 var DEFAULT_API_BASE = "https://api.withone.ai/v1";
 function getApiBase() {
+  const override = process.env.ONE_API_BASE?.trim();
+  if (override) return withV1(override);
+  const rc = readOneRc().ONE_API_BASE?.trim();
+  if (rc) return withV1(rc);
   const config = readConfig();
-  if (config?.apiBase) return `${config.apiBase}/v1`;
+  if (config?.apiBase) return withV1(config.apiBase);
   return DEFAULT_API_BASE;
 }
+function withV1(origin) {
+  const trimmed = origin.replace(/\/+$/, "");
+  return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;
+}
 function updateApiBase(url) {
   const config = readConfig();
   if (!config) return;
@@ -194,8 +202,23 @@ function updateApiBase(url) {
     delete config.apiBase;
   }
   delete config.whoami;
+  delete config.whoamiApiBase;
   writeConfig(config);
 }
+function saveCredentials(apiKey, scope, opts) {
+  const existing = scope === "project" ? readProjectConfig() : readGlobalConfig();
+  const next = {
+    ...existing,
+    apiKey,
+    installedAgents: existing?.installedAgents ?? [],
+    createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    whoami: opts.whoami,
+    whoamiApiBase: getApiBase()
+  };
+  if (opts.keyName) next.apiKeyName = opts.keyName;
+  else delete next.apiKeyName;
+  writeConfig(next, scope);
+}
 function getCacheTtl() {
   if (process.env.ONE_CACHE_TTL) {
     const val = parseInt(process.env.ONE_CACHE_TTL, 10);
@@ -229,12 +252,17 @@ function updateAccessControl(settings) {
   writeConfig(config);
 }
 function getWhoAmI() {
-  return readConfig()?.whoami ?? null;
+  const config = readConfig();
+  if (!config?.whoami) return null;
+  const fetchedFrom = config.whoamiApiBase ?? withV1(config.apiBase ?? DEFAULT_API_BASE);
+  if (fetchedFrom !== getApiBase()) return null;
+  return config.whoami;
 }
 function updateWhoAmI(whoami) {
   const config = readConfig();
   if (!config) return;
   config.whoami = whoami;
+  config.whoamiApiBase = getApiBase();
   writeConfig(config);
 }
 async function ensureWhoAmI(api) {
@@ -393,6 +421,7 @@ export {
   getAccessControl,
   getApiBase,
   updateApiBase,
+  saveCredentials,
   getCacheTtl,
   updateAccessControl,
   getWhoAmI,

package/dist/{chunk-OWDR5L3Q.js → chunk-KAF5SVJS.js}

@@ -3,10 +3,10 @@ import {
   isAgentMode,
   json,
   requireMemoryInit
-} from "./chunk-GNSR3NYN.js";
+} from "./chunk-OLQ55K6B.js";
 import {
   getBackend
-} from "./chunk-DDCDPVJH.js";
+} from "./chunk-VH46MAE4.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-GNSR3NYN.js → chunk-OLQ55K6B.js}

@@ -1,10 +1,10 @@
 import {
   getMemoryConfigOrDefault
-} from "./chunk-5O5KODGV.js";
+} from "./chunk-YMUY55U2.js";
 import {
   getOpenAiApiKey,
   readConfig
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/output.ts
 import * as p from "@clack/prompts";

package/dist/{chunk-WXJWF7QG.js → chunk-QCXFSOTS.js}

@@ -5,7 +5,7 @@ import {
 import {
   getCacheTtl,
   homeDir
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/flow-runner.ts
 import fs3 from "fs";
@@ -2354,7 +2354,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-MVSJ2GB7.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-QQ675PJD.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/{chunk-DDCDPVJH.js → chunk-VH46MAE4.js}

@@ -5,11 +5,11 @@ import {
   getMemoryConfig,
   getMemoryConfigOrDefault,
   updateMemoryConfig
-} from "./chunk-5O5KODGV.js";
+} from "./chunk-YMUY55U2.js";
 import {
   getOpenAiApiKey,
   homeDir
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/memory/schema.ts
 var SCHEMA_VERSION = "2.3.1";

package/dist/{chunk-FS4HAKZ6.js → chunk-XWTV7FA3.js}

@@ -6,11 +6,11 @@ import {
   note,
   okJson,
   requireMemoryInit
-} from "./chunk-GNSR3NYN.js";
+} from "./chunk-OLQ55K6B.js";
 import {
   getBackend,
   upsertRecord
-} from "./chunk-DDCDPVJH.js";
+} from "./chunk-VH46MAE4.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{chunk-5O5KODGV.js → chunk-YMUY55U2.js}

@@ -3,7 +3,7 @@ import {
   readConfig,
   setOpenAiApiKey,
   writeConfig
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/memory/config.ts
 var DEFAULT_MEMORY_CONFIG = {

package/dist/{embedding-Z2WCDN6R.js → embedding-OXX4OF65.js}

@@ -2,8 +2,8 @@ import {
   defaultSearchableText,
   embed,
   embedBatch
-} from "./chunk-5O5KODGV.js";
-import "./chunk-EVEUGRCB.js";
+} from "./chunk-YMUY55U2.js";
+import "./chunk-6UB623BG.js";
 export {
   defaultSearchableText,
   embed,

package/dist/{flow-runner-MVSJ2GB7.js → flow-runner-QQ675PJD.js}

@@ -12,9 +12,9 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-WXJWF7QG.js";
+} from "./chunk-QCXFSOTS.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-EVEUGRCB.js";
+import "./chunk-6UB623BG.js";
 export {
   FlowRunner,
   collectStepTypes,