@withone/cli 1.55.4 → 1.56.0

package/README.md

@@ -48,6 +48,8 @@ one login              # Opens browser for authentication (global or per-directo
 one logout             # Clear credentials (with scope picker and confirmation)
 ```
 
+The browser consent page names the key and tags it with where this CLI is installed (scope, project path, machine, OS user, CLI version, chosen harnesses, and the per-install device id unless telemetry is off) so you can find and revoke it from Settings → API keys. The terminal prints exactly what will be sent before the browser opens.
+
 Requires Node.js 18+. `one sync` additionally needs Node 20+, because its
 local SQLite engine (`better-sqlite3`, an optional dependency) ships prebuilt
 binaries only for Node 20 and above. On Node 18 every other command works
@@ -162,6 +164,10 @@ one init --auth manual --api-key sk_live_...   # headless / CI, no browser
 | `--auth <browser\|manual>` | Run setup with **no prompts**. `browser` opens a login window; `manual` uses `--api-key`. Scope from `-g`/`-p` (default global). |
 | `--api-key <key>` | API key for `--auth manual` (`sk_live_…` / `sk_test_…`) |
 | `--openai-key <key>` | Optional OpenAI key for `one mem` semantic search |
+| `ONE_APP_URL` (env) | Dashboard origin the browser flows open (default `https://app.withone.ai`); use `http://localhost:4202` against a local frontend. |
+| `ONE_API_BASE` (env) | API origin, overriding `apiBase` in config (default `https://api.withone.ai`); use `http://localhost:5005` against a local backend. |
+
+Both overrides apply to the current process only and are never written to config, so a key minted against a local backend lands in your normal config and a cron job or MCP server without the variable would send it to the hosted API. Pair them with `ONE_HOME` (see below) to keep a local stack's credentials in a separate profile.
 
 ### `one add <platform>`
 

package/dist/{chunk-EVEUGRCB.js → chunk-6UB623BG.js}

@@ -181,10 +181,18 @@ function getAccessControl() {
 }
 var DEFAULT_API_BASE = "https://api.withone.ai/v1";
 function getApiBase() {
+  const override = process.env.ONE_API_BASE?.trim();
+  if (override) return withV1(override);
+  const rc = readOneRc().ONE_API_BASE?.trim();
+  if (rc) return withV1(rc);
   const config = readConfig();
-  if (config?.apiBase) return `${config.apiBase}/v1`;
+  if (config?.apiBase) return withV1(config.apiBase);
   return DEFAULT_API_BASE;
 }
+function withV1(origin) {
+  const trimmed = origin.replace(/\/+$/, "");
+  return trimmed.endsWith("/v1") ? trimmed : `${trimmed}/v1`;
+}
 function updateApiBase(url) {
   const config = readConfig();
   if (!config) return;
@@ -194,8 +202,23 @@ function updateApiBase(url) {
     delete config.apiBase;
   }
   delete config.whoami;
+  delete config.whoamiApiBase;
   writeConfig(config);
 }
+function saveCredentials(apiKey, scope, opts) {
+  const existing = scope === "project" ? readProjectConfig() : readGlobalConfig();
+  const next = {
+    ...existing,
+    apiKey,
+    installedAgents: existing?.installedAgents ?? [],
+    createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    whoami: opts.whoami,
+    whoamiApiBase: getApiBase()
+  };
+  if (opts.keyName) next.apiKeyName = opts.keyName;
+  else delete next.apiKeyName;
+  writeConfig(next, scope);
+}
 function getCacheTtl() {
   if (process.env.ONE_CACHE_TTL) {
     const val = parseInt(process.env.ONE_CACHE_TTL, 10);
@@ -229,12 +252,17 @@ function updateAccessControl(settings) {
   writeConfig(config);
 }
 function getWhoAmI() {
-  return readConfig()?.whoami ?? null;
+  const config = readConfig();
+  if (!config?.whoami) return null;
+  const fetchedFrom = config.whoamiApiBase ?? withV1(config.apiBase ?? DEFAULT_API_BASE);
+  if (fetchedFrom !== getApiBase()) return null;
+  return config.whoami;
 }
 function updateWhoAmI(whoami) {
   const config = readConfig();
   if (!config) return;
   config.whoami = whoami;
+  config.whoamiApiBase = getApiBase();
   writeConfig(config);
 }
 async function ensureWhoAmI(api) {
@@ -393,6 +421,7 @@ export {
   getAccessControl,
   getApiBase,
   updateApiBase,
+  saveCredentials,
   getCacheTtl,
   updateAccessControl,
   getWhoAmI,

package/dist/{chunk-OWDR5L3Q.js → chunk-KAF5SVJS.js}

@@ -3,10 +3,10 @@ import {
   isAgentMode,
   json,
   requireMemoryInit
-} from "./chunk-GNSR3NYN.js";
+} from "./chunk-OLQ55K6B.js";
 import {
   getBackend
-} from "./chunk-DDCDPVJH.js";
+} from "./chunk-VH46MAE4.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{chunk-GNSR3NYN.js → chunk-OLQ55K6B.js}

@@ -1,10 +1,10 @@
 import {
   getMemoryConfigOrDefault
-} from "./chunk-5O5KODGV.js";
+} from "./chunk-YMUY55U2.js";
 import {
   getOpenAiApiKey,
   readConfig
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/output.ts
 import * as p from "@clack/prompts";

package/dist/{chunk-WXJWF7QG.js → chunk-QCXFSOTS.js}

@@ -5,7 +5,7 @@ import {
 import {
   getCacheTtl,
   homeDir
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/flow-runner.ts
 import fs3 from "fs";
@@ -2354,7 +2354,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-MVSJ2GB7.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-QQ675PJD.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/{chunk-DDCDPVJH.js → chunk-VH46MAE4.js}

@@ -5,11 +5,11 @@ import {
   getMemoryConfig,
   getMemoryConfigOrDefault,
   updateMemoryConfig
-} from "./chunk-5O5KODGV.js";
+} from "./chunk-YMUY55U2.js";
 import {
   getOpenAiApiKey,
   homeDir
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/memory/schema.ts
 var SCHEMA_VERSION = "2.3.1";

package/dist/{chunk-FS4HAKZ6.js → chunk-XWTV7FA3.js}

@@ -6,11 +6,11 @@ import {
   note,
   okJson,
   requireMemoryInit
-} from "./chunk-GNSR3NYN.js";
+} from "./chunk-OLQ55K6B.js";
 import {
   getBackend,
   upsertRecord
-} from "./chunk-DDCDPVJH.js";
+} from "./chunk-VH46MAE4.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{chunk-5O5KODGV.js → chunk-YMUY55U2.js}

@@ -3,7 +3,7 @@ import {
   readConfig,
   setOpenAiApiKey,
   writeConfig
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/lib/memory/config.ts
 var DEFAULT_MEMORY_CONFIG = {

package/dist/{embedding-Z2WCDN6R.js → embedding-OXX4OF65.js}

@@ -2,8 +2,8 @@ import {
   defaultSearchableText,
   embed,
   embedBatch
-} from "./chunk-5O5KODGV.js";
-import "./chunk-EVEUGRCB.js";
+} from "./chunk-YMUY55U2.js";
+import "./chunk-6UB623BG.js";
 export {
   defaultSearchableText,
   embed,

package/dist/{flow-runner-MVSJ2GB7.js → flow-runner-QQ675PJD.js}

@@ -12,9 +12,9 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-WXJWF7QG.js";
+} from "./chunk-QCXFSOTS.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-EVEUGRCB.js";
+import "./chunk-6UB623BG.js";
 export {
   FlowRunner,
   collectStepTypes,