@withone/cli 1.55.4 → 1.56.0

package/dist/index.js

@@ -32,10 +32,10 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-WXJWF7QG.js";
+} from "./chunk-QCXFSOTS.js";
 import {
   memSqlCommand
-} from "./chunk-OWDR5L3Q.js";
+} from "./chunk-KAF5SVJS.js";
 import {
   collectIdentityKeys,
   countRecords,
@@ -66,7 +66,7 @@ import {
   writeDraftProfile,
   writePageToMemory,
   writeProfile
-} from "./chunk-FS4HAKZ6.js";
+} from "./chunk-XWTV7FA3.js";
 import {
   getByDotPath
 } from "./chunk-44CV5IMX.js";
@@ -90,7 +90,7 @@ import {
   semanticSearchUpgradeLine,
   setAgentMode,
   silenceWarningsInAgentMode
-} from "./chunk-GNSR3NYN.js";
+} from "./chunk-OLQ55K6B.js";
 import {
   SCHEMA_VERSION,
   addRecord,
@@ -100,7 +100,7 @@ import {
   listBackendPlugins,
   loadBackendFromConfig,
   updateRecord
-} from "./chunk-DDCDPVJH.js";
+} from "./chunk-VH46MAE4.js";
 import {
   DEFAULT_MEMORY_CONFIG,
   defaultSearchableText,
@@ -110,7 +110,7 @@ import {
   memoryConfigExists,
   setOpenAiApiKey,
   updateMemoryConfig
-} from "./chunk-5O5KODGV.js";
+} from "./chunk-YMUY55U2.js";
 import {
   appendAnalyticsQueue,
   appendUsageLog,
@@ -138,6 +138,7 @@ import {
   readProjectConfig,
   readUsageState,
   resolveConfig,
+  saveCredentials,
   telemetryNoticeShown,
   updateAccessControl,
   updateApiBase,
@@ -146,18 +147,18 @@ import {
   writeConfig,
   writeUsageLog,
   writeUsageState
-} from "./chunk-EVEUGRCB.js";
+} from "./chunk-6UB623BG.js";
 
 // src/cli.ts
 import { createRequire as createRequire3 } from "module";
-import path12 from "path";
+import path13 from "path";
 import { Command } from "commander";
 
 // src/commands/init.ts
 import * as p3 from "@clack/prompts";
-import pc3 from "picocolors";
-import fs3 from "fs";
-import path4 from "path";
+import pc4 from "picocolors";
+import fs4 from "fs";
+import path5 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 
 // src/lib/agents.ts
@@ -259,6 +260,12 @@ function getAgents() {
     }
   ];
 }
+function detectInstalledAgents() {
+  return getAgents().filter((agent) => {
+    const detectDir = expandPath(agent.detectDir);
+    return fs.existsSync(detectDir);
+  });
+}
 function getAgentConfigPath(agent, scope = "global") {
   if (scope === "project" && agent.projectConfigPath) {
     return path.join(process.cwd(), agent.projectConfigPath);
@@ -341,94 +348,539 @@ function getAgentStatuses() {
 
 // src/lib/browser.ts
 import open from "open";
-var ONE_APP_URL = "https://app.withone.ai";
-function getConnectionUrl(platform, params) {
-  const searchParams = new URLSearchParams();
-  if (params?.orgId) searchParams.set("orgId", params.orgId);
-  if (params?.projectId) searchParams.set("projectId", params.projectId);
-  if (params?.env) searchParams.set("env", params.env);
-  const qs = searchParams.toString();
-  return `${ONE_APP_URL}/${qs ? `?${qs}` : ""}#open=${platform}`;
+
+// src/lib/install-context.ts
+import fs2 from "fs";
+import os from "os";
+import path3 from "path";
+
+// src/lib/analytics.ts
+import { createRequire as createRequire2 } from "module";
+import { randomUUID, createHash } from "crypto";
+import pc from "picocolors";
+
+// src/lib/version.ts
+import { createRequire } from "module";
+import { existsSync } from "fs";
+import path2 from "path";
+import { fileURLToPath } from "url";
+var require2 = createRequire(import.meta.url);
+var cached = null;
+function cliVersion() {
+  if (cached !== null) return cached;
+  const dir = path2.dirname(fileURLToPath(import.meta.url));
+  for (let i = 1; i <= 4; i++) {
+    const candidate = path2.resolve(dir, ...Array(i).fill(".."), "package.json");
+    if (!existsSync(candidate)) continue;
+    try {
+      const version2 = require2(candidate).version;
+      if (version2) {
+        cached = version2;
+        return cached;
+      }
+    } catch {
+    }
+  }
+  cached = "unknown";
+  return cached;
 }
-function getApiKeyUrl() {
-  return `${ONE_APP_URL}/settings/api-keys`;
+
+// src/lib/analytics.ts
+var require3 = createRequire2(import.meta.url);
+var DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
+var DEFAULT_POSTHOG_KEY = "phc_a9ok4w0uxiZcVoSWOISIlin85lHMXQD3vWPaYnuRlRV";
+var SEND_MAX_ATTEMPTS = 3;
+var QUEUE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var EXIT_GRACE_MS = 300;
+var inFlight = /* @__PURE__ */ new Set();
+var pending = /* @__PURE__ */ new Set();
+var dispatched = /* @__PURE__ */ new Set();
+var delivered = /* @__PURE__ */ new Set();
+var UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function uuidFromInsertId(insertId) {
+  if (UUID_SHAPE.test(insertId)) return insertId.toLowerCase();
+  const h = createHash("sha1").update(`one-cli-event:${insertId}`).digest("hex");
+  const variant = (parseInt(h[16], 16) & 3 | 8).toString(16);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-5${h.slice(13, 16)}-${variant}${h.slice(17, 20)}-${h.slice(20, 32)}`;
 }
-async function openConnectionPage(platform, params) {
-  const url = getConnectionUrl(platform, params);
-  await open(url);
+function posthogHost() {
+  return process.env.ONE_POSTHOG_HOST || DEFAULT_POSTHOG_HOST;
 }
-async function openApiKeyPage() {
-  await open(getApiKeyUrl());
+function posthogKey() {
+  return process.env.ONE_POSTHOG_KEY || DEFAULT_POSTHOG_KEY;
 }
-function getCliAuthUrl(port, state) {
-  return `${ONE_APP_URL}/cli/auth?port=${port}&state=${encodeURIComponent(state)}`;
+function envName() {
+  const key = getApiKey();
+  return key ? getEnvFromApiKey(key) : "live";
 }
-async function openCliAuthPage(port, state) {
-  const url = getCliAuthUrl(port, state);
-  await open(url);
+function isOn(value) {
+  return value === "1" || value === "true";
 }
-
-// src/commands/config.ts
-import * as p from "@clack/prompts";
-import pc from "picocolors";
-async function configCommand() {
-  if (isAgentMode()) {
-    error("This command requires interactive input. Run without --agent.");
+function debugLog(message) {
+  if (isOn(process.env.ONE_ANALYTICS_DEBUG)) {
+    process.stderr.write(`[analytics] ${message}
+`);
   }
-  const config2 = readConfig();
-  if (!config2) {
-    p.log.error(`No One config found. Run ${pc.cyan("one init")} first.`);
+}
+function isTelemetryDisabled() {
+  if (isOn(process.env.ONE_NO_TELEMETRY) || isOn(process.env.ONE_DISABLE_TELEMETRY)) return true;
+  if (isOn(process.env.DO_NOT_TRACK)) return true;
+  if (isOn(process.env.CI)) return true;
+  if (readConfig()?.telemetry === "off") return true;
+  return false;
+}
+function distinctId() {
+  return getWhoAmI()?.user?.id ?? getDeviceId();
+}
+function isAuthenticated() {
+  return !!getWhoAmI()?.user || !!getApiKey();
+}
+function baseProperties() {
+  return {
+    $lib: "one-cli",
+    cli_version: cliVersion(),
+    agent_mode: isAgentMode(),
+    env: envName(),
+    os: process.platform,
+    arch: process.arch,
+    node_version: process.versions.node,
+    authenticated: isAuthenticated()
+  };
+}
+function personSet() {
+  const whoami = getWhoAmI();
+  if (!whoami?.user) return void 0;
+  const set = {};
+  if (whoami.user.email) set.email = whoami.user.email;
+  if (whoami.user.name) set.name = whoami.user.name;
+  if (whoami.organization?.id) set.organization_id = whoami.organization.id;
+  return Object.keys(set).length ? set : void 0;
+}
+function send(item) {
+  const insertId = item.properties.$insert_id;
+  if (insertId) dispatched.add(insertId);
+  const controller = new AbortController();
+  inFlight.add(controller);
+  const run = (async () => {
+    try {
+      const res = await fetch(`${posthogHost()}/i/v0/e/`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          api_key: posthogKey(),
+          event: item.event,
+          distinct_id: item.distinct_id,
+          // PostHog's dedupe key — a re-sent copy is dropped on ingest.
+          uuid: item.uuid ?? (insertId ? uuidFromInsertId(insertId) : void 0),
+          properties: item.properties,
+          timestamp: item.timestamp
+        }),
+        signal: controller.signal
+      });
+      if (res.ok && insertId) delivered.add(insertId);
+      debugLog(`"${item.event}" -> HTTP ${res.status}${res.ok ? "" : " (retry next run)"}`);
+    } catch (err) {
+      debugLog(`"${item.event}" not sent: ${err instanceof Error ? err.message : String(err)} (retry next run)`);
+    } finally {
+      inFlight.delete(controller);
+    }
+  })();
+  pending.add(run);
+  void run.finally(() => pending.delete(run));
+}
+function capture(event, properties = {}, opts = {}) {
+  if (isTelemetryDisabled()) {
+    debugLog(`disabled \u2014 skipping "${event}"`);
     return;
   }
-  p.intro(pc.bgCyan(pc.black(" One Access Control ")));
-  const current = getAccessControl();
-  console.log();
-  console.log(`  ${pc.bold("Current Access Control")}`);
-  console.log(`  ${pc.dim("\u2500".repeat(42))}`);
-  console.log(`  ${pc.dim("Permissions:")}   ${current.permissions ?? "admin"}`);
-  console.log(`  ${pc.dim("Connections:")}   ${formatList(current.connectionKeys)}`);
-  console.log(`  ${pc.dim("Action IDs:")}    ${formatList(current.actionIds)}`);
-  console.log(`  ${pc.dim("Knowledge only:")} ${current.knowledgeAgent ? "yes" : "no"}`);
-  console.log();
-  const permissions = await p.select({
-    message: "Permission level",
-    options: [
-      { value: "admin", label: "Admin", hint: "Full access (GET, POST, PUT, PATCH, DELETE)" },
-      { value: "write", label: "Write", hint: "GET, POST, PUT, PATCH" },
-      { value: "read", label: "Read", hint: "GET only" }
-    ],
-    initialValue: current.permissions ?? "admin"
-  });
-  if (p.isCancel(permissions)) {
-    p.outro("No changes made.");
-    return;
+  const did = opts.distinctId ?? distinctId();
+  const props = { ...baseProperties(), ...properties };
+  if (props.$insert_id === void 0) props.$insert_id = randomUUID();
+  const insertId = props.$insert_id;
+  if (opts.personProfile === false) {
+    props.$process_person_profile = false;
+  } else if (did === distinctId()) {
+    const set = personSet();
+    if (set) props.$set = set;
   }
-  const connectionMode = await p.select({
-    message: "Connection scope",
-    options: [
-      { value: "all", label: "All connections" },
-      { value: "specific", label: "Select specific connections" }
-    ],
-    initialValue: current.connectionKeys ? "specific" : "all"
-  });
-  if (p.isCancel(connectionMode)) {
-    p.outro("No changes made.");
+  const item = {
+    event,
+    distinct_id: did,
+    properties: props,
+    timestamp: opts.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+    uuid: uuidFromInsertId(insertId)
+  };
+  appendAnalyticsQueue(JSON.stringify(item));
+}
+var ROLLUP_WINDOW_MS = 5 * 60 * 1e3;
+var ROLLUP_MAX_BATCH = 500;
+function utcDay(ts) {
+  return new Date(ts).toISOString().slice(0, 10);
+}
+var PRE_AUTH_COMMANDS = /* @__PURE__ */ new Set([
+  "init",
+  "login",
+  "logout",
+  "guide",
+  "platforms",
+  "onboard",
+  "config",
+  "update",
+  "help"
+]);
+function shouldRecord(commandPath2) {
+  if (isAuthenticated()) return true;
+  return PRE_AUTH_COMMANDS.has(commandPath2.split(" ")[0]);
+}
+function recordCommand(command) {
+  if (isTelemetryDisabled()) {
+    writeUsageLog([]);
     return;
   }
-  let connectionKeys;
-  if (connectionMode === "specific") {
-    connectionKeys = await selectConnections(config2.apiKey);
-    if (connectionKeys === void 0) {
-      p.outro("No changes made.");
-      return;
-    }
-    if (connectionKeys.length === 0) {
-      p.log.info(`No connections found. Defaulting to all. Use ${pc.cyan("one add")} to connect platforms.`);
-      connectionKeys = void 0;
-    }
+  const cmdPath = commandPath(command);
+  if (!shouldRecord(cmdPath)) return;
+  const did = distinctId();
+  const entry = { ts: Date.now(), command: cmdPath, agent: isAgentMode(), did };
+  appendUsageLog(JSON.stringify(entry));
+  const today = utcDay(entry.ts);
+  const state = readUsageState();
+  const firstTouch = state.lastDay !== today || state.distinctId !== did;
+  flushUsageRollups({ force: firstTouch });
+  if (firstTouch) writeUsageState({ lastDay: today, distinctId: did });
+}
+function flushUsageRollups(opts = {}) {
+  if (isTelemetryDisabled()) {
+    writeUsageLog([]);
+    return;
   }
-  const actionMode = await p.select({
-    message: "Action scope",
+  const lines = claimUsageLog();
+  if (!lines || lines.length === 0) return;
+  const entries = [];
+  for (const line of lines) {
+    try {
+      const e = JSON.parse(line);
+      if (e && typeof e.ts === "number" && typeof e.command === "string" && typeof e.did === "string") {
+        entries.push(e);
+      }
+    } catch {
+    }
+  }
+  if (entries.length === 0) return;
+  const currentDid = entries[entries.length - 1].did;
+  const now = Date.now();
+  const groups = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const g = groups.get(e.did);
+    if (g) g.push(e);
+    else groups.set(e.did, [e]);
+  }
+  const kept = [];
+  for (const [did, group] of groups) {
+    const due = opts.force === true || did !== currentDid || // a superseded login's batch — flush it now
+    group.length >= ROLLUP_MAX_BATCH || now - group[0].ts >= ROLLUP_WINDOW_MS;
+    if (due) emitRollup(did, group);
+    else kept.push(...group);
+  }
+  for (const e of kept) appendUsageLog(JSON.stringify(e));
+}
+function emitRollup(did, group) {
+  const byCommand = {};
+  let agentCount = 0;
+  for (const e of group) {
+    byCommand[e.command] = (byCommand[e.command] ?? 0) + 1;
+    if (e.agent) agentCount += 1;
+  }
+  const insertId = createHash("sha1").update(`${did}|${group.map((e) => `${e.ts}:${e.command}:${e.agent ? 1 : 0}`).join("|")}`).digest("hex");
+  capture(
+    "CLI Usage Rollup",
+    {
+      command_count: group.length,
+      by_command: byCommand,
+      agent_count: agentCount,
+      human_count: group.length - agentCount,
+      window_start: new Date(group[0].ts).toISOString(),
+      window_end: new Date(group[group.length - 1].ts).toISOString(),
+      $insert_id: insertId
+    },
+    {
+      distinctId: did,
+      timestamp: new Date(group[group.length - 1].ts).toISOString(),
+      // Rollups bill at the anonymous rate; the person already exists.
+      personProfile: false
+    }
+  );
+  debugLog(`rollup \u2014 ${group.length} command(s) for ${did}`);
+}
+function commandPath(command) {
+  const parts = [];
+  let current = command;
+  while (current && current.name() && current.name() !== "one") {
+    parts.unshift(current.name());
+    current = current.parent;
+  }
+  return parts.join(" ") || command.name();
+}
+function drainQueue() {
+  if (isTelemetryDisabled()) {
+    writeAnalyticsQueue([]);
+    return;
+  }
+  const now = Date.now();
+  const kept = [];
+  let changed = false;
+  for (const line of readAnalyticsQueue()) {
+    let item;
+    try {
+      item = JSON.parse(line);
+    } catch {
+      changed = true;
+      continue;
+    }
+    const insertId = item?.properties?.$insert_id;
+    if (!insertId) {
+      changed = true;
+      continue;
+    }
+    const age = now - Date.parse(item.timestamp);
+    const attempts = item.attempts ?? 0;
+    if (!(age < QUEUE_MAX_AGE_MS) || attempts >= SEND_MAX_ATTEMPTS) {
+      debugLog(`"${item.event}" dropped (${attempts} attempts, ${Math.round(age / 6e4)} min old)`);
+      changed = true;
+      continue;
+    }
+    if (dispatched.has(insertId)) {
+      kept.push(line);
+      continue;
+    }
+    item.attempts = attempts + 1;
+    if (!item.uuid) item.uuid = uuidFromInsertId(insertId);
+    kept.push(JSON.stringify(item));
+    changed = true;
+    send(item);
+  }
+  if (changed) writeAnalyticsQueue(kept);
+}
+async function flush() {
+  if (pending.size > 0) {
+    await Promise.race([
+      Promise.allSettled([...pending]),
+      new Promise((resolve) => setTimeout(resolve, EXIT_GRACE_MS))
+    ]);
+  }
+  for (const controller of inFlight) controller.abort();
+  const remaining = readAnalyticsQueue().filter((line) => {
+    try {
+      const item = JSON.parse(line);
+      const id = item.properties?.$insert_id;
+      if (!id || delivered.has(id)) return false;
+      return (item.attempts ?? 0) < SEND_MAX_ATTEMPTS;
+    } catch {
+      return false;
+    }
+  });
+  writeAnalyticsQueue(remaining);
+  dispatched.clear();
+  delivered.clear();
+}
+function maybeShowTelemetryNotice() {
+  if (isTelemetryDisabled() || isAgentMode()) return;
+  if (telemetryNoticeShown()) return;
+  markTelemetryNoticeShown();
+  process.stderr.write(
+    pc.dim(
+      "One CLI collects usage analytics (which commands run, linked to your One account) to improve the product.\nNo arguments, inputs, or secrets are ever collected. Opt out anytime with ONE_NO_TELEMETRY=1.\n"
+    )
+  );
+}
+
+// src/lib/install-context.ts
+var EXTRA_HARNESS_DIRS = [
+  { id: "gemini-cli", dir: ".gemini" },
+  { id: "openclaw", dir: ".openclaw" },
+  { id: "hermes", dir: ".hermes" },
+  { id: "devin", dir: ".devin" }
+];
+var LAUNCHER_ENV = [
+  { id: "claude-code", vars: ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT"] },
+  { id: "codex", vars: ["CODEX_SANDBOX", "CODEX_CI", "CODEX_THREAD_ID"] },
+  { id: "gemini-cli", vars: ["GEMINI_CLI"] },
+  // CURSOR_TRACE_ID is deliberately absent: Cursor exports it into every
+  // integrated-terminal shell, so it marks the editor, not an agent.
+  { id: "cursor", vars: ["CURSOR_AGENT"] },
+  { id: "windsurf", vars: ["WINDSURF_AGENT"] },
+  { id: "kiro", vars: ["KIRO_AGENT"] },
+  { id: "openclaw", vars: ["OPENCLAW_AGENT", "OPENCLAW_SESSION"] },
+  { id: "hermes", vars: ["HERMES_AGENT", "HERMES_SESSION"] },
+  { id: "devin", vars: ["DEVIN_SESSION_ID"] }
+];
+function detectLauncher(env = process.env) {
+  for (const entry of LAUNCHER_ENV) {
+    if (entry.vars.some((v) => env[v] !== void 0 && env[v] !== "")) return entry.id;
+  }
+  return void 0;
+}
+function detectInstalledHarnesses() {
+  const ids = new Set(detectInstalledAgents().map((a) => a.id));
+  for (const { id, dir } of EXTRA_HARNESS_DIRS) {
+    if (fs2.existsSync(path3.join(homeDir(), dir))) ids.add(id);
+  }
+  return [...ids].sort();
+}
+function tryRead(read) {
+  try {
+    const value = read();
+    return value === null || value === "" ? void 0 : value;
+  } catch {
+    return void 0;
+  }
+}
+function collectInstallContext(opts) {
+  const env = opts.env ?? process.env;
+  const ctx = {
+    scope: opts.scope,
+    harnesses: tryRead(() => detectInstalledHarnesses()) ?? []
+  };
+  if (opts.scope === "project") {
+    ctx.path = opts.projectRoot ?? tryRead(() => getProjectRoot());
+  }
+  ctx.host = tryRead(() => os.hostname());
+  ctx.os = process.platform;
+  ctx.osVersion = tryRead(() => os.release());
+  ctx.arch = process.arch;
+  ctx.user = tryRead(() => os.userInfo().username);
+  if (!isTelemetryDisabled()) ctx.device = tryRead(() => getDeviceId());
+  const cli = tryRead(() => cliVersion());
+  ctx.cli = cli === "unknown" ? void 0 : cli;
+  ctx.launcher = detectLauncher(env);
+  return ctx;
+}
+function installContextToParams(ctx) {
+  const params = new URLSearchParams();
+  const set = (key, value) => {
+    if (value !== void 0 && value !== "") params.set(key, value);
+  };
+  set("scope", ctx.scope);
+  set("path", ctx.path);
+  set("host", ctx.host);
+  set("os", ctx.os);
+  set("osv", ctx.osVersion);
+  set("arch", ctx.arch);
+  set("user", ctx.user);
+  set("device", ctx.device);
+  set("cli", ctx.cli);
+  if (ctx.harnesses.length > 0) params.set("harnesses", ctx.harnesses.join(","));
+  set("launcher", ctx.launcher);
+  return params;
+}
+function describeInstallContext(ctx) {
+  const lines = [`scope: ${ctx.scope}`];
+  if (ctx.path) lines.push(`path: ${ctx.path}`);
+  if (ctx.host || ctx.os) {
+    const osPart = [ctx.os, ctx.osVersion].filter(Boolean).join(" ");
+    const detail = [osPart, ctx.arch].filter(Boolean).join(", ");
+    lines.push(`machine: ${ctx.host ?? "unknown"}${detail ? ` (${detail})` : ""}`);
+  }
+  if (ctx.user) lines.push(`user: ${ctx.user}`);
+  if (ctx.device) lines.push(`device: ${ctx.device}`);
+  if (ctx.harnesses.length > 0) lines.push(`harnesses: ${ctx.harnesses.join(", ")}`);
+  if (ctx.launcher) lines.push(`launched by: ${ctx.launcher}`);
+  if (ctx.cli) lines.push(`cli: ${ctx.cli}`);
+  return lines.join("\n");
+}
+
+// src/lib/browser.ts
+var DEFAULT_APP_URL = "https://app.withone.ai";
+function oneAppUrl() {
+  const override = process.env.ONE_APP_URL?.trim();
+  return (override || DEFAULT_APP_URL).replace(/\/+$/, "");
+}
+function getConnectionUrl(platform, params) {
+  const searchParams = new URLSearchParams();
+  if (params?.orgId) searchParams.set("orgId", params.orgId);
+  if (params?.projectId) searchParams.set("projectId", params.projectId);
+  if (params?.env) searchParams.set("env", params.env);
+  const qs = searchParams.toString();
+  return `${oneAppUrl()}/${qs ? `?${qs}` : ""}#open=${platform}`;
+}
+function getApiKeyUrl() {
+  return `${oneAppUrl()}/settings/api-keys`;
+}
+async function openConnectionPage(platform, params) {
+  await open(getConnectionUrl(platform, params));
+}
+async function openApiKeyPage() {
+  await open(getApiKeyUrl());
+}
+function getCliAuthUrl(port, state, context) {
+  const params = new URLSearchParams([
+    ["port", String(port)],
+    ["state", state],
+    ...context ? installContextToParams(context) : []
+  ]);
+  return `${oneAppUrl()}/cli/auth?${params.toString()}`;
+}
+
+// src/commands/config.ts
+import * as p from "@clack/prompts";
+import pc2 from "picocolors";
+async function configCommand() {
+  if (isAgentMode()) {
+    error("This command requires interactive input. Run without --agent.");
+  }
+  const config2 = readConfig();
+  if (!config2) {
+    p.log.error(`No One config found. Run ${pc2.cyan("one init")} first.`);
+    return;
+  }
+  p.intro(pc2.bgCyan(pc2.black(" One Access Control ")));
+  const current = getAccessControl();
+  console.log();
+  console.log(`  ${pc2.bold("Current Access Control")}`);
+  console.log(`  ${pc2.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc2.dim("Permissions:")}   ${current.permissions ?? "admin"}`);
+  console.log(`  ${pc2.dim("Connections:")}   ${formatList(current.connectionKeys)}`);
+  console.log(`  ${pc2.dim("Action IDs:")}    ${formatList(current.actionIds)}`);
+  console.log(`  ${pc2.dim("Knowledge only:")} ${current.knowledgeAgent ? "yes" : "no"}`);
+  console.log();
+  const permissions = await p.select({
+    message: "Permission level",
+    options: [
+      { value: "admin", label: "Admin", hint: "Full access (GET, POST, PUT, PATCH, DELETE)" },
+      { value: "write", label: "Write", hint: "GET, POST, PUT, PATCH" },
+      { value: "read", label: "Read", hint: "GET only" }
+    ],
+    initialValue: current.permissions ?? "admin"
+  });
+  if (p.isCancel(permissions)) {
+    p.outro("No changes made.");
+    return;
+  }
+  const connectionMode = await p.select({
+    message: "Connection scope",
+    options: [
+      { value: "all", label: "All connections" },
+      { value: "specific", label: "Select specific connections" }
+    ],
+    initialValue: current.connectionKeys ? "specific" : "all"
+  });
+  if (p.isCancel(connectionMode)) {
+    p.outro("No changes made.");
+    return;
+  }
+  let connectionKeys;
+  if (connectionMode === "specific") {
+    connectionKeys = await selectConnections(config2.apiKey);
+    if (connectionKeys === void 0) {
+      p.outro("No changes made.");
+      return;
+    }
+    if (connectionKeys.length === 0) {
+      p.log.info(`No connections found. Defaulting to all. Use ${pc2.cyan("one add")} to connect platforms.`);
+      connectionKeys = void 0;
+    }
+  }
+  const actionMode = await p.select({
+    message: "Action scope",
     options: [
       { value: "all", label: "All actions" },
       { value: "specific", label: "Restrict to specific action IDs" }
@@ -464,8 +916,8 @@ async function configCommand() {
     p.outro("No changes made.");
     return;
   }
-  const currentBase = getApiBase();
-  const isCustomBase = !!readConfig()?.apiBase;
+  const storedBase = readConfig()?.apiBase;
+  const isCustomBase = !!storedBase;
   const baseUrlMode = await p.select({
     message: "API base URL",
     options: [
@@ -483,7 +935,7 @@ async function configCommand() {
     const customUrl = await p.text({
       message: "Enter API base URL:",
       placeholder: "https://development-api.withone.ai",
-      initialValue: isCustomBase ? currentBase.replace(/\/v1$/, "") : "",
+      initialValue: storedBase ? storedBase.replace(/\/v1$/, "") : "",
       validate: (value) => {
         if (!value) return "URL is required";
         try {
@@ -500,7 +952,7 @@ async function configCommand() {
     }
     const normalized = customUrl.replace(/\/+$/, "").replace(/\/v1$/, "");
     const apiKey = await p.text({
-      message: `Enter your API key for ${pc.cyan(normalized)}:`,
+      message: `Enter your API key for ${pc2.cyan(normalized)}:`,
       placeholder: "sk_live_...",
       validate: (value) => {
         if (!value) return "API key is required";
@@ -514,29 +966,29 @@ async function configCommand() {
       p.outro("No changes made.");
       return;
     }
-    const spinner5 = p.spinner();
-    spinner5.start("Validating API key...");
+    const spinner4 = p.spinner();
+    spinner4.start("Validating API key...");
     let isValid = false;
     try {
       const api = new OneApi(apiKey, `${normalized}/v1`);
       isValid = Boolean(await api.validateApiKey());
     } catch (err) {
-      spinner5.stop("Connection failed");
+      spinner4.stop("Connection failed");
       const msg = err instanceof Error ? err.message : String(err);
-      p.log.error(`Could not reach ${pc.cyan(normalized)}: ${msg}`);
+      p.log.error(`Could not reach ${pc2.cyan(normalized)}: ${msg}`);
       return;
     }
     if (!isValid) {
-      spinner5.stop("Invalid API key");
-      p.log.error(`Invalid API key for ${pc.cyan(normalized)}.`);
+      spinner4.stop("Invalid API key");
+      p.log.error(`Invalid API key for ${pc2.cyan(normalized)}.`);
       return;
     }
-    spinner5.stop("API key validated");
+    spinner4.stop("API key validated");
     updateApiBase(normalized);
     newApiKey = apiKey;
   } else if (isCustomBase) {
     const apiKey = await p.text({
-      message: `Enter your API key for ${pc.cyan("https://api.withone.ai")}:`,
+      message: `Enter your API key for ${pc2.cyan("https://api.withone.ai")}:`,
       placeholder: "sk_live_...",
       validate: (value) => {
         if (!value) return "API key is required";
@@ -550,24 +1002,24 @@ async function configCommand() {
       p.outro("No changes made.");
       return;
     }
-    const spinner5 = p.spinner();
-    spinner5.start("Validating API key...");
+    const spinner4 = p.spinner();
+    spinner4.start("Validating API key...");
     let isValid = false;
     try {
       const api = new OneApi(apiKey, "https://api.withone.ai/v1");
       isValid = Boolean(await api.validateApiKey());
     } catch (err) {
-      spinner5.stop("Connection failed");
+      spinner4.stop("Connection failed");
       const msg = err instanceof Error ? err.message : String(err);
-      p.log.error(`Could not reach ${pc.cyan("https://api.withone.ai")}: ${msg}`);
+      p.log.error(`Could not reach ${pc2.cyan("https://api.withone.ai")}: ${msg}`);
       return;
     }
     if (!isValid) {
-      spinner5.stop("Invalid API key");
+      spinner4.stop("Invalid API key");
       p.log.error(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
       return;
     }
-    spinner5.stop("API key validated");
+    spinner4.stop("API key validated");
     updateApiBase(null);
     newApiKey = apiKey;
   }
@@ -581,7 +1033,9 @@ async function configCommand() {
   const updatedConfig = readConfig();
   if (updatedConfig && newApiKey !== config2.apiKey) {
     updatedConfig.apiKey = newApiKey;
+    delete updatedConfig.apiKeyName;
     delete updatedConfig.whoami;
+    delete updatedConfig.whoamiApiBase;
     writeConfig(updatedConfig);
   }
   const ac = getAccessControl();
@@ -603,16 +1057,16 @@ async function configCommand() {
   p.outro("Configuration updated.");
 }
 async function selectConnections(apiKey) {
-  const spinner5 = p.spinner();
-  spinner5.start("Fetching connections...");
+  const spinner4 = p.spinner();
+  spinner4.start("Fetching connections...");
   let connections;
   try {
     const api = new OneApi(apiKey, getApiBase());
     const rawConnections = await api.listConnections();
     connections = rawConnections.map((c) => ({ platform: c.platform, key: c.key }));
-    spinner5.stop(`Found ${connections.length} connection(s)`);
+    spinner4.stop(`Found ${connections.length} connection(s)`);
   } catch {
-    spinner5.stop("Could not fetch connections");
+    spinner4.stop("Could not fetch connections");
     const manual = await p.text({
       message: "Enter connection keys manually (comma-separated):",
       placeholder: "conn_key_1, conn_key_2",
@@ -645,46 +1099,18 @@ function formatList(list) {
 }
 
 // src/commands/init.ts
-import open2 from "open";
+import open3 from "open";
 
 // src/lib/skill-sync.ts
-import fs2 from "fs";
-import path3 from "path";
+import fs3 from "fs";
+import path4 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/commands/update.ts
 import { spawn } from "child_process";
 import { existsSync as existsSync2, readFileSync, writeFileSync, mkdirSync, rmSync, openSync, closeSync } from "fs";
 import { delimiter, dirname, join } from "path";
-import pc2 from "picocolors";
-
-// src/lib/version.ts
-import { createRequire } from "module";
-import { existsSync } from "fs";
-import path2 from "path";
-import { fileURLToPath } from "url";
-var require2 = createRequire(import.meta.url);
-var cached = null;
-function cliVersion() {
-  if (cached !== null) return cached;
-  const dir = path2.dirname(fileURLToPath(import.meta.url));
-  for (let i = 1; i <= 4; i++) {
-    const candidate = path2.resolve(dir, ...Array(i).fill(".."), "package.json");
-    if (!existsSync(candidate)) continue;
-    try {
-      const version2 = require2(candidate).version;
-      if (version2) {
-        cached = version2;
-        return cached;
-      }
-    } catch {
-    }
-  }
-  cached = "unknown";
-  return cached;
-}
-
-// src/commands/update.ts
+import pc3 from "picocolors";
 var currentVersion = cliVersion();
 var ONE_DIR = () => join(homeDir(), ".one");
 var CACHE_PATH = () => join(ONE_DIR(), "update-check.json");
@@ -860,10 +1286,10 @@ function maybeWarnAboutFailedUpdates(targetVersion) {
   if (!shouldWarnAboutFailedUpdates(state)) return;
   writeAutoUpdateState({ ...state, lastNoticeAt: Date.now() });
   process.stderr.write(
-    pc2.yellow(
+    pc3.yellow(
       `One CLI could not auto-update (v${currentVersion} \u2192 v${targetVersion}) after ${state.failures} attempts.
 `
-    ) + pc2.dim(
+    ) + pc3.dim(
       `Update manually with: npm install -g @withone/cli@latest
 Details: ${LOG_PATH()}. Silence this with ONE_NO_AUTO_UPDATE=1.
 `
@@ -960,42 +1386,42 @@ function autoUpdate(targetVersion, publishedAt) {
 var CANONICAL_SKILL_DIR = ".agents/skills";
 var VERSION_MARKER = ".one-cli-version";
 function getPackagedSkillDir() {
-  const here = path3.dirname(fileURLToPath2(import.meta.url));
-  return path3.resolve(here, "..", "skills", "one");
+  const here = path4.dirname(fileURLToPath2(import.meta.url));
+  return path4.resolve(here, "..", "skills", "one");
 }
 function getCanonicalSkillPath() {
-  return path3.join(homeDir(), CANONICAL_SKILL_DIR, "one");
+  return path4.join(homeDir(), CANONICAL_SKILL_DIR, "one");
 }
 function getVersionMarkerPath() {
-  return path3.join(getCanonicalSkillPath(), VERSION_MARKER);
+  return path4.join(getCanonicalSkillPath(), VERSION_MARKER);
 }
 function isSkillInstalled() {
-  return fs2.existsSync(path3.join(getCanonicalSkillPath(), "SKILL.md"));
+  return fs3.existsSync(path4.join(getCanonicalSkillPath(), "SKILL.md"));
 }
 function readInstalledSkillVersion() {
   try {
-    return fs2.readFileSync(getVersionMarkerPath(), "utf-8").trim() || null;
+    return fs3.readFileSync(getVersionMarkerPath(), "utf-8").trim() || null;
   } catch {
     return null;
   }
 }
 function writeInstalledSkillVersion(version2) {
   try {
-    fs2.mkdirSync(getCanonicalSkillPath(), { recursive: true });
-    fs2.writeFileSync(getVersionMarkerPath(), `${version2}
+    fs3.mkdirSync(getCanonicalSkillPath(), { recursive: true });
+    fs3.writeFileSync(getVersionMarkerPath(), `${version2}
 `);
   } catch {
   }
 }
 function copyDirSync(src, dest) {
-  fs2.mkdirSync(dest, { recursive: true });
-  for (const entry of fs2.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path3.join(src, entry.name);
-    const destPath = path3.join(dest, entry.name);
+  fs3.mkdirSync(dest, { recursive: true });
+  for (const entry of fs3.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path4.join(src, entry.name);
+    const destPath = path4.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync(srcPath, destPath);
     } else {
-      fs2.copyFileSync(srcPath, destPath);
+      fs3.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -1018,7 +1444,7 @@ function forceSyncSkills() {
 }
 function performSync(current, reason) {
   const source = getPackagedSkillDir();
-  if (!fs2.existsSync(path3.join(source, "SKILL.md"))) {
+  if (!fs3.existsSync(path4.join(source, "SKILL.md"))) {
     return { synced: false, reason: "source-missing" };
   }
   const canonical = getCanonicalSkillPath();
@@ -1047,21 +1473,36 @@ function getSkillStatus() {
 // src/commands/login.ts
 import http from "http";
 import crypto from "crypto";
+import open2 from "open";
 import * as p2 from "@clack/prompts";
 var LOGIN_TIMEOUT_MS = 5 * 60 * 1e3;
 var PORT_RANGE_START = 49152;
 var PORT_RANGE_END = 65535;
 var MAX_PORT_ATTEMPTS = 5;
-var SUCCESS_HTML = `<!DOCTYPE html>
+var MAX_KEY_NAME_LENGTH = 120;
+var MAX_ERROR_LENGTH = 200;
+var CHECK_MARK = `<div style="width:48px;height:48px;border-radius:50%;background:rgba(34,197,94,0.1);display:flex;align-items:center;justify-content:center;margin:0 auto 16px">
+<svg width="24" height="24" fill="none" stroke="#22c55e" stroke-width="2" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/></svg>
+</div>`;
+function statusPage(title, body, check = false) {
+  return `<!DOCTYPE html>
 <html><head><title>One CLI</title></head>
 <body style="font-family:system-ui;display:flex;justify-content:center;align-items:center;height:100vh;margin:0;background:#0a0a0a;color:#fafafa">
 <div style="text-align:center">
-<div style="width:48px;height:48px;border-radius:50%;background:rgba(34,197,94,0.1);display:flex;align-items:center;justify-content:center;margin:0 auto 16px">
-<svg width="24" height="24" fill="none" stroke="#22c55e" stroke-width="2" viewBox="0 0 24 24"><path stroke-linecap="round" stroke-linejoin="round" d="M5 13l4 4L19 7"/></svg>
-</div>
-<h1 style="font-size:20px;margin:0 0 8px">You're all set!</h1>
-<p style="color:#a1a1aa;font-size:14px">Return to your terminal. You can close this tab.</p>
+${check ? CHECK_MARK : ""}
+<h1 style="font-size:20px;margin:0 0 8px">${title}</h1>
+<p style="color:#a1a1aa;font-size:14px">${body}</p>
 </div></body></html>`;
+}
+var SUCCESS_HTML = statusPage("You're all set!", "Return to your terminal. You can close this tab.", true);
+var CANCELLED_HTML = statusPage("Login cancelled", "No key was created. You can close this tab and run <code>one login</code> again.");
+var FAILED_HTML = statusPage("Login did not complete", "The consent page reported an error. Return to your terminal for details, then run <code>one login</code> again.");
+function cleanParam(value, max) {
+  if (value === null) return void 0;
+  const cleaned = value.replace(/[\u0000-\u001f\u007f-\u009f]/g, "").trim();
+  if (!cleaned) return void 0;
+  return Array.from(cleaned).slice(0, max).join("");
+}
 function randomPort() {
   return PORT_RANGE_START + Math.floor(Math.random() * (PORT_RANGE_END - PORT_RANGE_START));
 }
@@ -1082,12 +1523,10 @@ function startCallbackServer(expectedState) {
           res.end("Not found");
           return;
         }
-        const encodedKey = url.searchParams.get("s");
         const state = url.searchParams.get("state");
-        const apiKey = encodedKey ? Buffer.from(encodedKey, "base64").toString("utf-8") : null;
-        if (!apiKey || !state) {
+        if (!state) {
           res.writeHead(400, { "Content-Type": "text/plain" });
-          res.end("Missing required parameters");
+          res.end("Missing state");
           return;
         }
         if (state !== expectedState) {
@@ -1095,12 +1534,38 @@ function startCallbackServer(expectedState) {
           res.end("State mismatch");
           return;
         }
-        res.writeHead(200, { "Content-Type": "text/html" });
-        res.end(SUCCESS_HTML);
-        resolveResult({ apiKey, state });
+        const encodedKey = url.searchParams.get("s");
+        if (encodedKey) {
+          const apiKey = Buffer.from(encodedKey, "base64").toString("utf-8");
+          if (!apiKey) {
+            res.writeHead(400, { "Content-Type": "text/plain" });
+            res.end("Missing required parameters");
+            return;
+          }
+          const keyName = cleanParam(url.searchParams.get("name"), MAX_KEY_NAME_LENGTH);
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(SUCCESS_HTML);
+          resolveResult({ kind: "key", apiKey, keyName });
+          return;
+        }
+        const error2 = cleanParam(url.searchParams.get("error"), MAX_ERROR_LENGTH);
+        if (error2 === "cancelled") {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(CANCELLED_HTML);
+          resolveResult({ kind: "cancelled" });
+          return;
+        }
+        if (error2) {
+          res.writeHead(200, { "Content-Type": "text/html" });
+          res.end(FAILED_HTML);
+          resolveResult({ kind: "failed", reason: error2 });
+          return;
+        }
+        res.writeHead(400, { "Content-Type": "text/plain" });
+        res.end("Missing required parameters");
       });
       server.on("error", (err) => {
-        if (err.code === "EADDRINUSE" && attempts < MAX_PORT_ATTEMPTS) {
+        if ((err.code === "EADDRINUSE" || err.code === "EACCES") && attempts < MAX_PORT_ATTEMPTS) {
           tryListen();
           return;
         }
@@ -1113,9 +1578,9 @@ function startCallbackServer(expectedState) {
     tryListen();
   });
 }
-async function browserLogin() {
+async function browserLogin(opts) {
   const state = crypto.randomUUID();
-  const spin = p2.spinner();
+  const spin = createSpinner();
   let server;
   let port;
   let resultPromise;
@@ -1125,14 +1590,24 @@ async function browserLogin() {
     error("Could not start local server. Try: one init");
     return null;
   }
-  const authUrl = getCliAuthUrl(port, state);
-  p2.note(
-    `If the browser doesn't open, visit:
-${authUrl}`,
-    "Opening browser for authentication..."
-  );
+  const context = collectInstallContext({ scope: opts.scope });
+  const authUrl = getCliAuthUrl(port, state, context);
+  if (isAgentMode()) {
+    process.stderr.write(`Opening the browser for authentication. If it doesn't open, visit:
+${authUrl}
+`);
+  } else {
+    note(
+      `If the browser doesn't open, visit:
+${authUrl}
+
+The consent page records this on the key so you can find the install later:
+${describeInstallContext(context)}`,
+      "Opening browser for authentication..."
+    );
+  }
   try {
-    await openCliAuthPage(port, state);
+    await open2(authUrl);
   } catch {
   }
   spin.start("Waiting for authentication... (timeout: 5 min)");
@@ -1143,12 +1618,20 @@ ${authUrl}`,
     timer.unref();
   });
   try {
-    const payload = await Promise.race([resultPromise, timeout]);
+    const outcome = await Promise.race([resultPromise, timeout]);
+    if (outcome.kind === "cancelled") {
+      spin.stop("Login cancelled in the browser.");
+      return null;
+    }
+    if (outcome.kind === "failed") {
+      spin.stop("Authentication failed.");
+      error(`The consent page reported an error: ${outcome.reason}. Try again with: one login`);
+    }
     spin.stop("Authentication received!");
     const apiBase = getApiBase();
-    const api = new OneApi(payload.apiKey, apiBase);
+    const api = new OneApi(outcome.apiKey, apiBase);
     const whoami = await api.whoami();
-    return { apiKey: payload.apiKey, whoami };
+    return { apiKey: outcome.apiKey, whoami, keyName: outcome.keyName };
   } catch (err) {
     spin.stop("Authentication failed.");
     if (err instanceof Error && err.message === "timeout") {
@@ -1164,17 +1647,6 @@ ${authUrl}`,
     server.close();
   }
 }
-function saveCredentials(apiKey, scope) {
-  const existing = scope === "project" ? readProjectConfig() : readGlobalConfig();
-  writeConfig({
-    apiKey,
-    installedAgents: existing?.installedAgents ?? [],
-    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    accessControl: existing?.accessControl,
-    cacheTtl: existing?.cacheTtl,
-    apiBase: existing?.apiBase
-  }, scope);
-}
 async function loginCommand() {
   if (isAgentMode()) {
     json({ error: "Browser login not available in agent mode. Use: one init" });
@@ -1184,11 +1656,11 @@ async function loginCommand() {
   const existingKey = getApiKey();
   if (existingKey) {
     const pc17 = (await import("picocolors")).default;
-    const resolved2 = resolveConfig();
-    const whoami2 = resolved2.config?.whoami;
+    const resolved = resolveConfig();
+    const whoami2 = resolved.config?.whoami;
     const env2 = getEnvFromApiKey(existingKey);
     const envLabel2 = env2 === "test" ? pc17.yellow("test") : pc17.green("live");
-    const currentScope = resolved2.scope === "project" ? pc17.cyan("local config") : pc17.magenta("global config");
+    const currentScope = resolved.scope === "project" ? pc17.cyan("local config") : pc17.magenta("global config");
     const lines = ["You are already logged in.", ""];
     if (whoami2) {
       const contextParts2 = [];
@@ -1216,14 +1688,10 @@ async function loginCommand() {
     }
     targetScope = scopeChoice;
   }
-  const result = await browserLogin();
+  const result = await browserLogin({ scope: targetScope });
   if (!result) return;
-  const { apiKey, whoami } = result;
-  saveCredentials(apiKey, targetScope);
-  const resolved = resolveConfig();
-  if (resolved.config) {
-    writeConfig({ ...resolved.config, whoami }, targetScope);
-  }
+  const { apiKey, whoami, keyName } = result;
+  saveCredentials(apiKey, targetScope, { keyName, whoami });
   const pc16 = (await import("picocolors")).default;
   const env = getEnvFromApiKey(apiKey);
   const contextParts = [];
@@ -1236,6 +1704,7 @@ async function loginCommand() {
     `${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`,
     `${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`
   ];
+  if (keyName) infoLines.push(`${pc16.dim("Key:")} ${keyName}`);
   if (whoami.organization) infoLines.push(`${pc16.dim("Org:")} ${whoami.organization.name}`);
   if (whoami.project) infoLines.push(`${pc16.dim("Project:")} ${whoami.project.name}`);
   infoLines.push("");
@@ -1291,13 +1760,15 @@ async function nonInteractiveInit(options) {
   }
   const scope = options.global ? "global" : options.project ? "project" : "global";
   let apiKey;
+  let keyName;
   let whoami;
   if (auth === "browser") {
-    const result = await browserLogin();
+    const result = await browserLogin({ scope });
     if (!result) {
       error("Browser login did not complete. Try again: one init --auth browser");
     }
     apiKey = result.apiKey;
+    keyName = result.keyName;
     whoami = result.whoami;
   } else {
     const key = options.apiKey?.trim();
@@ -1321,19 +1792,7 @@ async function nonInteractiveInit(options) {
     apiKey = key;
     whoami = validated;
   }
-  const existing = scope === "project" ? readProjectConfig() : readGlobalConfig();
-  writeConfig(
-    {
-      apiKey,
-      installedAgents: existing?.installedAgents ?? [],
-      createdAt: existing?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-      accessControl: existing?.accessControl,
-      apiBase: existing?.apiBase,
-      cacheTtl: existing?.cacheTtl,
-      whoami
-    },
-    scope
-  );
+  saveCredentials(apiKey, scope, { keyName, whoami });
   if (options.openaiKey?.trim()) {
     try {
       setOpenAiApiKey(options.openaiKey.trim());
@@ -1355,6 +1814,7 @@ async function nonInteractiveInit(options) {
         project: whoami.project,
         env: getEnvFromApiKey(apiKey)
       },
+      keyName,
       skillInstalled: installed,
       skillFailed: failed
     });
@@ -1365,18 +1825,19 @@ async function nonInteractiveInit(options) {
   if (whoami.organization) contextParts.push(whoami.organization.name);
   if (whoami.project) contextParts.push(whoami.project.name);
   const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-  const envLabel = env === "test" ? pc3.yellow("test") : pc3.green("live");
+  const envLabel = env === "test" ? pc4.yellow("test") : pc4.green("live");
   console.log();
-  console.log(`  ${pc3.bold("Setup complete")} ${scopeLabel(scope)}`);
-  console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
-  console.log(`  ${pc3.dim("Account:")} ${scopeDisplay} ${pc3.dim("\xB7")} ${envLabel}`);
-  console.log(`  ${pc3.dim("User:")}    ${whoami.user.name} ${pc3.dim(`(${whoami.user.email})`)}`);
-  console.log(`  ${pc3.dim("Config:")}  ${tildify(configPath)}`);
+  console.log(`  ${pc4.bold("Setup complete")} ${scopeLabel(scope)}`);
+  console.log(`  ${pc4.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc4.dim("Account:")} ${scopeDisplay} ${pc4.dim("\xB7")} ${envLabel}`);
+  console.log(`  ${pc4.dim("User:")}    ${whoami.user.name} ${pc4.dim(`(${whoami.user.email})`)}`);
+  if (keyName) console.log(`  ${pc4.dim("Key:")}     ${keyName}`);
+  console.log(`  ${pc4.dim("Config:")}  ${tildify(configPath)}`);
   if (installed.length > 0) {
-    console.log(`  ${pc3.dim("Skill:")}   ${pc3.green("installed")} ${pc3.dim("\xB7 " + installed.join(", "))}`);
+    console.log(`  ${pc4.dim("Skill:")}   ${pc4.green("installed")} ${pc4.dim("\xB7 " + installed.join(", "))}`);
   }
   console.log();
-  console.log(`  ${pc3.dim("Connect a platform later with")} ${pc3.cyan("one add <platform>")}`);
+  console.log(`  ${pc4.dim("Connect a platform later with")} ${pc4.cyan("one add <platform>")}`);
   printOnboardingPrompt();
 }
 async function chooseConfigScope(options) {
@@ -1386,13 +1847,13 @@ async function chooseConfigScope(options) {
   const hasGlobal = globalConfigExists();
   const hasProject = projectConfigExists();
   const projectRoot = resolved.projectRoot;
-  const projectName = path4.basename(projectRoot);
+  const projectName = path5.basename(projectRoot);
   const homeGlobal = tildify(getGlobalConfigPath());
   const homeProject = tildify(getProjectConfigPath(projectRoot));
   if (hasProject) {
     console.log();
-    console.log(`  ${pc3.dim("Project:")}  ${projectName}   ${pc3.dim(projectRoot)}`);
-    console.log(`  ${pc3.bold("Active config:")} ${pc3.cyan("project")} ${pc3.dim("\xB7 " + homeProject)}`);
+    console.log(`  ${pc4.dim("Project:")}  ${projectName}   ${pc4.dim(projectRoot)}`);
+    console.log(`  ${pc4.bold("Active config:")} ${pc4.cyan("project")} ${pc4.dim("\xB7 " + homeProject)}`);
     console.log();
     if (hasGlobal) {
       const which2 = await p3.select({
@@ -1409,11 +1870,11 @@ async function chooseConfigScope(options) {
     return "project";
   }
   console.log();
-  console.log(`  ${pc3.bold("Initializing One")}`);
-  console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
-  console.log(`  ${pc3.dim("Project:")}  ${projectName}   ${pc3.dim(projectRoot)}`);
-  console.log(`  ${pc3.dim("Global:")}   ${hasGlobal ? pc3.green("\u2713 configured") : pc3.yellow("\u2014 not set up")}   ${pc3.dim(homeGlobal)}`);
-  console.log(`  ${pc3.dim("Project:")}  ${pc3.yellow("\u2014 not set up")}   ${pc3.dim(homeProject)}`);
+  console.log(`  ${pc4.bold("Initializing One")}`);
+  console.log(`  ${pc4.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc4.dim("Project:")}  ${projectName}   ${pc4.dim(projectRoot)}`);
+  console.log(`  ${pc4.dim("Global:")}   ${hasGlobal ? pc4.green("\u2713 configured") : pc4.yellow("\u2014 not set up")}   ${pc4.dim(homeGlobal)}`);
+  console.log(`  ${pc4.dim("Project:")}  ${pc4.yellow("\u2014 not set up")}   ${pc4.dim(homeProject)}`);
   console.log();
   const defaultScope = hasGlobal ? "project" : "global";
   const hint = hasGlobal ? "Your global config stays as-is. This folder gets its own setup." : "No global config yet \u2014 this becomes your default for every folder.";
@@ -1442,7 +1903,7 @@ function tildify(filePath) {
   return filePath.startsWith(home) ? "~" + filePath.slice(home.length) : filePath;
 }
 function scopeLabel(scope) {
-  return scope === "project" ? pc3.cyan("[project]") : pc3.magenta("[global]");
+  return scope === "project" ? pc4.cyan("[project]") : pc4.magenta("[global]");
 }
 function scopedMessage(scope, message) {
   return `${scopeLabel(scope)} ${message}`;
@@ -1453,20 +1914,20 @@ async function handleExistingConfig(apiKey, scope, options) {
   const skillInstalled = isSkillInstalled2();
   const activeConfigPath = scope === "project" ? getProjectConfigPath() : getGlobalConfigPath();
   console.log();
-  console.log(`  ${pc3.bold("Current Setup")} ${scopeLabel(scope)}`);
-  console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
-  console.log(`  ${pc3.dim("API Key:")}  ${masked}`);
-  console.log(`  ${pc3.dim("Skill:")}    ${skillInstalled ? pc3.green("installed") : pc3.yellow("not installed")}`);
-  console.log(`  ${pc3.dim("Config:")}   ${tildify(activeConfigPath)}`);
+  console.log(`  ${pc4.bold("Current Setup")} ${scopeLabel(scope)}`);
+  console.log(`  ${pc4.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc4.dim("API Key:")}  ${masked}`);
+  console.log(`  ${pc4.dim("Skill:")}    ${skillInstalled ? pc4.green("installed") : pc4.yellow("not installed")}`);
+  console.log(`  ${pc4.dim("Config:")}   ${tildify(activeConfigPath)}`);
   const ac = getAccessControl();
   if (Object.keys(ac).length > 0) {
     console.log();
-    console.log(`  ${pc3.bold("Access Control")}`);
-    console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
-    if (ac.permissions) console.log(`  ${pc3.dim("Permissions:")}   ${ac.permissions}`);
-    if (ac.connectionKeys) console.log(`  ${pc3.dim("Connections:")}   ${ac.connectionKeys.join(", ")}`);
-    if (ac.actionIds) console.log(`  ${pc3.dim("Action IDs:")}    ${ac.actionIds.join(", ")}`);
-    if (ac.knowledgeAgent) console.log(`  ${pc3.dim("Knowledge only:")} yes`);
+    console.log(`  ${pc4.bold("Access Control")}`);
+    console.log(`  ${pc4.dim("\u2500".repeat(42))}`);
+    if (ac.permissions) console.log(`  ${pc4.dim("Permissions:")}   ${ac.permissions}`);
+    if (ac.connectionKeys) console.log(`  ${pc4.dim("Connections:")}   ${ac.connectionKeys.join(", ")}`);
+    if (ac.actionIds) console.log(`  ${pc4.dim("Action IDs:")}    ${ac.actionIds.join(", ")}`);
+    if (ac.knowledgeAgent) console.log(`  ${pc4.dim("Knowledge only:")} yes`);
   }
   console.log();
   const actionOptions = [];
@@ -1565,18 +2026,20 @@ async function handleUpdateKey(statuses, scope) {
     process.exit(0);
   }
   let newKey;
+  let keyName;
   let whoamiResult;
   if (authMethod === "browser") {
-    const result = await browserLogin();
+    const result = await browserLogin({ scope });
     if (!result) {
       p3.cancel("Browser login did not complete.");
       process.exit(1);
     }
     newKey = result.apiKey;
+    keyName = result.keyName;
     whoamiResult = result.whoami;
   } else {
     p3.note(`Get your API key at:
-${pc3.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
+${pc4.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
     const openBrowser = await p3.confirm({
       message: scopedMessage(scope, "Open browser to get API key?"),
       initialValue: true
@@ -1604,16 +2067,16 @@ ${pc3.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
       process.exit(0);
     }
     newKey = inputKey;
-    const spinner5 = p3.spinner();
-    spinner5.start("Validating API key...");
+    const spinner4 = p3.spinner();
+    spinner4.start("Validating API key...");
     const api = new OneApi(newKey, getApiBase());
     const validated = await api.validateApiKey();
     if (!validated) {
-      spinner5.stop("Invalid API key");
+      spinner4.stop("Invalid API key");
       p3.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
       process.exit(1);
     }
-    spinner5.stop("API key validated");
+    spinner4.stop("API key validated");
     whoamiResult = validated;
   }
   const env = getEnvFromApiKey(newKey);
@@ -1621,10 +2084,13 @@ ${pc3.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
   if (whoamiResult.organization) contextParts.push(whoamiResult.organization.name);
   if (whoamiResult.project) contextParts.push(whoamiResult.project.name);
   const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-  const envLabel = env === "test" ? pc3.yellow("test") : pc3.green("live");
+  const envLabel = env === "test" ? pc4.yellow("test") : pc4.green("live");
   p3.note(
-    `${scopeDisplay} ${pc3.dim("\xB7")} ${envLabel}
-${whoamiResult.user.name} ${pc3.dim(`(${whoamiResult.user.email})`)}`,
+    [
+      `${scopeDisplay} ${pc4.dim("\xB7")} ${envLabel}`,
+      `${whoamiResult.user.name} ${pc4.dim(`(${whoamiResult.user.email})`)}`,
+      ...keyName ? [`${pc4.dim("Key:")} ${keyName}`] : []
+    ].join("\n"),
     "Account"
   );
   const ac = getAccessControl();
@@ -1639,19 +2105,7 @@ ${whoamiResult.user.name} ${pc3.dim(`(${whoamiResult.user.email})`)}`,
       reinstalled.push(`${s.agent.name} (project)`);
     }
   }
-  const current = scope === "project" ? readProjectConfig() : readGlobalConfig();
-  writeConfig(
-    {
-      apiKey: newKey,
-      installedAgents: current?.installedAgents ?? [],
-      createdAt: current?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-      accessControl: current?.accessControl,
-      apiBase: current?.apiBase,
-      cacheTtl: current?.cacheTtl,
-      whoami: whoamiResult
-    },
-    scope
-  );
+  saveCredentials(newKey, scope, { keyName, whoami: whoamiResult });
   if (reinstalled.length > 0) {
     p3.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
   }
@@ -1671,30 +2125,30 @@ var SKILL_AGENTS = [
 ];
 var CANONICAL_SKILL_DIR2 = ".agents/skills";
 function getSkillSourceDir() {
-  const __dirname2 = path4.dirname(fileURLToPath3(import.meta.url));
-  return path4.resolve(__dirname2, "..", "skills", "one");
+  const __dirname2 = path5.dirname(fileURLToPath3(import.meta.url));
+  return path5.resolve(__dirname2, "..", "skills", "one");
 }
 function getCanonicalSkillPath2() {
-  return path4.join(homeDir(), CANONICAL_SKILL_DIR2, "one");
+  return path5.join(homeDir(), CANONICAL_SKILL_DIR2, "one");
 }
 function getAgentSkillPath(agent) {
-  return path4.join(homeDir(), agent.skillDir, "one");
+  return path5.join(homeDir(), agent.skillDir, "one");
 }
 function isSkillInstalled2() {
-  return fs3.existsSync(path4.join(getCanonicalSkillPath2(), "SKILL.md"));
+  return fs4.existsSync(path5.join(getCanonicalSkillPath2(), "SKILL.md"));
 }
 function isSkillInstalledForAgent(agent) {
-  return fs3.existsSync(path4.join(getAgentSkillPath(agent), "SKILL.md"));
+  return fs4.existsSync(path5.join(getAgentSkillPath(agent), "SKILL.md"));
 }
 function copyDirSync2(src, dest) {
-  fs3.mkdirSync(dest, { recursive: true });
-  for (const entry of fs3.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path4.join(src, entry.name);
-    const destPath = path4.join(dest, entry.name);
+  fs4.mkdirSync(dest, { recursive: true });
+  for (const entry of fs4.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path5.join(src, entry.name);
+    const destPath = path5.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirSync2(srcPath, destPath);
     } else {
-      fs3.copyFileSync(srcPath, destPath);
+      fs4.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -1703,12 +2157,12 @@ function installSkillForAgents(agentIds) {
   const canonical = getCanonicalSkillPath2();
   const installed = [];
   const failed = [];
-  if (!fs3.existsSync(path4.join(source, "SKILL.md"))) {
+  if (!fs4.existsSync(path5.join(source, "SKILL.md"))) {
     return { installed: [], failed: ["skill source not found"] };
   }
   try {
-    if (fs3.existsSync(canonical)) {
-      fs3.rmSync(canonical, { recursive: true });
+    if (fs4.existsSync(canonical)) {
+      fs4.rmSync(canonical, { recursive: true });
     }
     copyDirSync2(source, canonical);
     writeInstalledSkillVersion(getCurrentVersion());
@@ -1725,15 +2179,15 @@ function installSkillForAgents(agentIds) {
       continue;
     }
     try {
-      const agentSkillsDir = path4.dirname(agentPath);
-      fs3.mkdirSync(agentSkillsDir, { recursive: true });
+      const agentSkillsDir = path5.dirname(agentPath);
+      fs4.mkdirSync(agentSkillsDir, { recursive: true });
       try {
-        fs3.lstatSync(agentPath);
-        fs3.rmSync(agentPath, { recursive: true });
+        fs4.lstatSync(agentPath);
+        fs4.rmSync(agentPath, { recursive: true });
       } catch {
       }
-      const relative = path4.relative(agentSkillsDir, canonical);
-      fs3.symlinkSync(relative, agentPath);
+      const relative = path5.relative(agentSkillsDir, canonical);
+      fs4.symlinkSync(relative, agentPath);
       installed.push(agent.name);
       seen.set(agentPath, true);
     } catch {
@@ -1748,7 +2202,7 @@ async function promptOpenAiKey(scope) {
   const entered = await p3.password({
     message: scopedMessage(
       scope,
-      `OpenAI API key ${pc3.dim("(optional \u2014 enables semantic search in `one mem`)")}`
+      `OpenAI API key ${pc4.dim("(optional \u2014 enables semantic search in `one mem`)")}`
     ),
     mask: "\u2022",
     // Validator accepts empty → treated as "skip".
@@ -1803,7 +2257,7 @@ async function promptSkillInstall() {
     ...primaryAgents.map((a) => ({
       value: a.id,
       label: a.name,
-      hint: isSkillInstalledForAgent(a) ? pc3.green("installed") : void 0
+      hint: isSkillInstalledForAgent(a) ? pc4.green("installed") : void 0
     })),
     {
       value: "_other",
@@ -1827,7 +2281,7 @@ async function promptSkillInstall() {
       options: otherAgents.map((a) => ({
         value: a.id,
         label: a.name,
-        hint: isSkillInstalledForAgent(a) ? pc3.green("installed") : void 0
+        hint: isSkillInstalledForAgent(a) ? pc4.green("installed") : void 0
       }))
     });
     if (!p3.isCancel(otherChoice)) {
@@ -1838,12 +2292,12 @@ async function promptSkillInstall() {
     p3.log.info("No agents selected.");
     return false;
   }
-  const spinner5 = p3.spinner();
-  spinner5.start("Installing skill...");
+  const spinner4 = p3.spinner();
+  spinner4.start("Installing skill...");
   const { installed, failed } = installSkillForAgents(selectedIds);
-  spinner5.stop(installed.length > 0 ? "Skill installed" : "Installation failed");
+  spinner4.stop(installed.length > 0 ? "Skill installed" : "Installation failed");
   for (const name of installed) {
-    p3.log.success(`${name}: ${pc3.green("\u2713")} skill installed`);
+    p3.log.success(`${name}: ${pc4.green("\u2713")} skill installed`);
   }
   for (const name of failed) {
     p3.log.warn(`${name}: failed to install`);
@@ -1852,19 +2306,19 @@ async function promptSkillInstall() {
 }
 function printOnboardingPrompt() {
   console.log();
-  console.log(pc3.bold("  Copy-paste this to your AI agent:"));
+  console.log(pc4.bold("  Copy-paste this to your AI agent:"));
   console.log();
-  console.log(pc3.cyan("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(pc3.cyan("  \u2502"));
-  console.log(pc3.cyan("  \u2502  The One CLI (`one`) is now installed on this machine. It"));
-  console.log(pc3.cyan("  \u2502  lets you interact with 600+ third-party platforms (Gmail,"));
-  console.log(pc3.cyan("  \u2502  Slack, Shopify, HubSpot, Stripe, GitHub, etc.) through"));
-  console.log(pc3.cyan("  \u2502  their APIs. Whenever you need to interact with any"));
-  console.log(pc3.cyan("  \u2502  third-party platform or external service, use the `one`"));
-  console.log(pc3.cyan("  \u2502  skill. Please save this to your project instructions or"));
-  console.log(pc3.cyan("  \u2502  memory so you remember it in future conversations."));
-  console.log(pc3.cyan("  \u2502"));
-  console.log(pc3.cyan("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc4.cyan("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc4.cyan("  \u2502"));
+  console.log(pc4.cyan("  \u2502  The One CLI (`one`) is now installed on this machine. It"));
+  console.log(pc4.cyan("  \u2502  lets you interact with 600+ third-party platforms (Gmail,"));
+  console.log(pc4.cyan("  \u2502  Slack, Shopify, HubSpot, Stripe, GitHub, etc.) through"));
+  console.log(pc4.cyan("  \u2502  their APIs. Whenever you need to interact with any"));
+  console.log(pc4.cyan("  \u2502  third-party platform or external service, use the `one`"));
+  console.log(pc4.cyan("  \u2502  skill. Please save this to your project instructions or"));
+  console.log(pc4.cyan("  \u2502  memory so you remember it in future conversations."));
+  console.log(pc4.cyan("  \u2502"));
+  console.log(pc4.cyan("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log();
 }
 async function freshSetup(scope, options) {
@@ -1881,7 +2335,7 @@ async function freshSetup(scope, options) {
   }
   let apiKey;
   if (authMethod === "browser") {
-    const result = await browserLogin();
+    const result = await browserLogin({ scope });
     if (!result) {
       p3.cancel("Browser login did not complete. Try: one init");
       process.exit(1);
@@ -1892,24 +2346,19 @@ async function freshSetup(scope, options) {
     if (result.whoami.organization) contextParts.push(result.whoami.organization.name);
     if (result.whoami.project) contextParts.push(result.whoami.project.name);
     const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-    const envLabel = env2 === "test" ? pc3.yellow("test") : pc3.green("live");
+    const envLabel = env2 === "test" ? pc4.yellow("test") : pc4.green("live");
     p3.note(
-      `${scopeDisplay} ${pc3.dim("\xB7")} ${envLabel}
-${result.whoami.user.name} ${pc3.dim(`(${result.whoami.user.email})`)}`,
+      [
+        `${scopeDisplay} ${pc4.dim("\xB7")} ${envLabel}`,
+        `${result.whoami.user.name} ${pc4.dim(`(${result.whoami.user.email})`)}`,
+        ...result.keyName ? [`${pc4.dim("Key:")} ${result.keyName}`] : []
+      ].join("\n"),
       "Account"
     );
-    writeConfig(
-      {
-        apiKey,
-        installedAgents: [],
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        whoami: result.whoami
-      },
-      scope
-    );
+    saveCredentials(apiKey, scope, { keyName: result.keyName, whoami: result.whoami });
   } else {
     p3.note(`Get your API key at:
-${pc3.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
+${pc4.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
     const openBrowser = await p3.confirm({
       message: scopedMessage(scope, "Open browser to get API key?"),
       initialValue: true
@@ -1937,36 +2386,28 @@ ${pc3.cyan(getApiKeyUrl())}`, `API Key ${scopeLabel(scope)}`);
       process.exit(0);
     }
     apiKey = inputKey;
-    const spinner5 = p3.spinner();
-    spinner5.start("Validating API key...");
+    const spinner4 = p3.spinner();
+    spinner4.start("Validating API key...");
     const api = new OneApi(apiKey, getApiBase());
     const whoami = await api.validateApiKey();
     if (!whoami) {
-      spinner5.stop("Invalid API key");
+      spinner4.stop("Invalid API key");
       p3.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
       process.exit(1);
     }
-    spinner5.stop("API key validated");
+    spinner4.stop("API key validated");
     const env2 = getEnvFromApiKey(apiKey);
     const contextParts = [];
     if (whoami.organization) contextParts.push(whoami.organization.name);
     if (whoami.project) contextParts.push(whoami.project.name);
     const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-    const envLabel = env2 === "test" ? pc3.yellow("test") : pc3.green("live");
+    const envLabel = env2 === "test" ? pc4.yellow("test") : pc4.green("live");
     p3.note(
-      `${scopeDisplay} ${pc3.dim("\xB7")} ${envLabel}
-${whoami.user.name} ${pc3.dim(`(${whoami.user.email})`)}`,
+      `${scopeDisplay} ${pc4.dim("\xB7")} ${envLabel}
+${whoami.user.name} ${pc4.dim(`(${whoami.user.email})`)}`,
       "Account"
     );
-    writeConfig(
-      {
-        apiKey,
-        installedAgents: [],
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        whoami
-      },
-      scope
-    );
+    saveCredentials(apiKey, scope, { whoami });
   }
   await promptOpenAiKey(scope);
   await promptSkillInstall();
@@ -1979,11 +2420,11 @@ ${whoami.user.name} ${pc3.dim(`(${whoami.user.email})`)}`,
   };
   await promptConnectIntegrations(apiKey, connParams);
   const savedPath = scope === "project" ? getProjectConfigPath() : getGlobalConfigPath();
-  const resolutionHint = scope === "project" ? `When you run ${pc3.cyan("one")} from ${pc3.bold(path4.basename(getProjectRoot()))}, it uses this project config.
+  const resolutionHint = scope === "project" ? `When you run ${pc4.cyan("one")} from ${pc4.bold(path5.basename(getProjectRoot()))}, it uses this project config.
 From anywhere else, it falls back to your global config.` : `This config applies to every folder unless a project config is set.`;
   p3.note(
     `${scopeLabel(scope)} Config saved to:
-${pc3.dim(tildify(savedPath))}
+${pc4.dim(tildify(savedPath))}
 
 ${resolutionHint}`,
     "Setup Complete"
@@ -1993,18 +2434,18 @@ ${resolutionHint}`,
 }
 function printBanner() {
   console.log();
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   "));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   "));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc3.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588      \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   "));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   "));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588       "));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc4.yellow("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588      \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
   console.log();
-  console.log(pc3.dim("  I N F R A S T R U C T U R E   F O R   A G E N T S"));
+  console.log(pc4.dim("  I N F R A S T R U C T U R E   F O R   A G E N T S"));
   console.log();
 }
 var TOP_INTEGRATIONS = [
@@ -2043,19 +2484,20 @@ async function promptConnectIntegrations(apiKey, connParams) {
       break;
     }
     if (choice === "more") {
+      const connectionsUrl = `${oneAppUrl()}/connections`;
       try {
-        await open2("https://app.withone.ai/connections");
+        await open3(connectionsUrl);
         p3.log.info("Opened One dashboard in browser.");
       } catch {
-        p3.note("https://app.withone.ai/connections", "Open in browser");
+        p3.note(connectionsUrl, "Open in browser");
       }
-      p3.log.info(`Connect from the dashboard, or use ${pc3.cyan("one add <platform>")}`);
+      p3.log.info(`Connect from the dashboard, or use ${pc4.cyan("one add <platform>")}`);
       break;
     }
     const platform = choice;
     const integration = TOP_INTEGRATIONS.find((i) => i.value === platform);
     const label = integration?.label ?? platform;
-    p3.log.info(`Opening browser to connect ${pc3.cyan(label)}...`);
+    p3.log.info(`Opening browser to connect ${pc4.cyan(label)}...`);
     try {
       await openConnectionPage(platform, connParams);
     } catch {
@@ -2063,18 +2505,18 @@ async function promptConnectIntegrations(apiKey, connParams) {
       p3.log.warn("Could not open browser automatically.");
       p3.note(url, "Open manually");
     }
-    const spinner5 = p3.spinner();
-    spinner5.start("Waiting for connection... (complete auth in browser)");
+    const spinner4 = p3.spinner();
+    spinner4.start("Waiting for connection... (complete auth in browser)");
     try {
       await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
-      spinner5.stop(`${label} connected!`);
-      p3.log.success(`${pc3.green("\u2713")} ${label} is now available to your AI agents`);
+      spinner4.stop(`${label} connected!`);
+      p3.log.success(`${pc4.green("\u2713")} ${label} is now available to your AI agents`);
       connected.push(platform);
       first = false;
     } catch (error2) {
-      spinner5.stop("Connection timed out");
+      spinner4.stop("Connection timed out");
       if (error2 instanceof TimeoutError) {
-        p3.log.warn(`No worries. Connect later with: ${pc3.cyan(`one add ${platform}`)}`);
+        p3.log.warn(`No worries. Connect later with: ${pc4.cyan(`one add ${platform}`)}`);
       }
       first = false;
     }
@@ -2091,7 +2533,7 @@ function maskApiKey(key) {
 
 // src/commands/connection.ts
 import * as p4 from "@clack/prompts";
-import pc5 from "picocolors";
+import pc6 from "picocolors";
 
 // src/lib/access.ts
 async function resolveAllowedActions(api, actionIds) {
@@ -2177,7 +2619,7 @@ function countMatchingChars(a, b) {
 }
 
 // src/lib/table.ts
-import pc4 from "picocolors";
+import pc5 from "picocolors";
 function printTable(columns, rows) {
   if (rows.length === 0) return;
   const gap = "  ";
@@ -2189,10 +2631,10 @@ function printTable(columns, rows) {
   });
   const header = columns.map((col, i) => {
     const padded = col.align === "right" ? col.label.padStart(widths[i]) : col.label.padEnd(widths[i]);
-    return pc4.dim(padded);
+    return pc5.dim(padded);
   }).join(gap);
   console.log(`${indent}${header}`);
-  const separator = columns.map((_, i) => pc4.dim("\u2500".repeat(widths[i]))).join(gap);
+  const separator = columns.map((_, i) => pc5.dim("\u2500".repeat(widths[i]))).join(gap);
   console.log(`${indent}${separator}`);
   for (const row of rows) {
     const line = columns.map((col, i) => {
@@ -2217,21 +2659,21 @@ async function connectionAddCommand(platformArg, options) {
   if (isAgentMode()) {
     error("This command requires interactive input. Run without --agent.");
   }
-  p4.intro(pc5.bgCyan(pc5.black(" One ")));
+  p4.intro(pc6.bgCyan(pc6.black(" One ")));
   const apiKey = getApiKey();
   if (!apiKey) {
     p4.cancel("Not configured. Run `one init` first.");
     process.exit(1);
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = p4.spinner();
-  spinner5.start("Loading platforms...");
+  const spinner4 = p4.spinner();
+  spinner4.start("Loading platforms...");
   let platforms;
   try {
     platforms = await api.listPlatforms();
-    spinner5.stop(`${platforms.length} platforms available`);
+    spinner4.stop(`${platforms.length} platforms available`);
   } catch (error2) {
-    spinner5.stop("Failed to load platforms");
+    spinner4.stop("Failed to load platforms");
     p4.cancel(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
     process.exit(1);
   }
@@ -2252,7 +2694,7 @@ async function connectionAddCommand(platformArg, options) {
           ]
         });
         if (p4.isCancel(suggestion) || suggestion === "__other__") {
-          p4.note(`Run ${pc5.cyan("one platforms")} to see all available platforms.`);
+          p4.note(`Run ${pc6.cyan("one platforms")} to see all available platforms.`);
           p4.cancel("Connection cancelled.");
           process.exit(0);
         }
@@ -2260,7 +2702,7 @@ async function connectionAddCommand(platformArg, options) {
       } else {
         p4.cancel(`Unknown platform: ${platformArg}
 
-Run ${pc5.cyan("one platforms")} to see available platforms.`);
+Run ${pc6.cyan("one platforms")} to see available platforms.`);
         process.exit(1);
       }
     }
@@ -2283,7 +2725,7 @@ Run ${pc5.cyan("one platforms")} to see available platforms.`);
     } else {
       p4.cancel(`Unknown platform: ${platformInput}
 
-Run ${pc5.cyan("one platforms")} to see available platforms.`);
+Run ${pc6.cyan("one platforms")} to see available platforms.`);
       process.exit(1);
     }
   }
@@ -2294,8 +2736,8 @@ Run ${pc5.cyan("one platforms")} to see available platforms.`);
     ...whoami?.project && { projectId: whoami.project.id }
   };
   const url = getConnectionUrl(platform, connParams);
-  p4.log.info(`Opening browser to connect ${pc5.cyan(platform)}...`);
-  p4.note(pc5.dim(url), "URL");
+  p4.log.info(`Opening browser to connect ${pc6.cyan(platform)}...`);
+  p4.note(pc6.dim(url), "URL");
   try {
     await openConnectionPage(platform, connParams);
   } catch {
@@ -2323,7 +2765,7 @@ The connection is usable; set the tag later in the dashboard or retry.`
         );
       }
     }
-    p4.log.success(`${pc5.green("\u2713")} ${connection2.platform} is now available to your AI agents.${tag ? ` (tag: ${tag})` : ""}`);
+    p4.log.success(`${pc6.green("\u2713")} ${connection2.platform} is now available to your AI agents.${tag ? ` (tag: ${tag})` : ""}`);
     p4.outro("Connection complete!");
   } catch (error2) {
     pollSpinner.stop("Connection timed out");
@@ -2334,7 +2776,7 @@ The connection is usable; set the tag later in the dashboard or retry.`
   - Browser popup was blocked
   - Wrong account selected
 
-Try again with: ${pc5.cyan(`one connection add ${platform}`)}`,
+Try again with: ${pc6.cyan(`one connection add ${platform}`)}`,
         "Timed Out"
       );
     } else {
@@ -2349,8 +2791,8 @@ async function connectionListCommand(options) {
     error("Not configured. Run `one init` first.");
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading connections...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading connections...");
   try {
     const allConnections = await api.listConnections();
     const ac = getAccessControlFromAllSources();
@@ -2392,20 +2834,20 @@ async function connectionListCommand(options) {
       return;
     }
     const displayed = limitArg !== void 0 ? filtered.slice(0, limitArg) : filtered;
-    spinner5.stop(`${filtered.length} connection${filtered.length === 1 ? "" : "s"} found`);
+    spinner4.stop(`${filtered.length} connection${filtered.length === 1 ? "" : "s"} found`);
     if (filtered.length === 0) {
       if (searchQuery) {
         p4.note(
           `No connections matching "${searchQuery}".
 
-Try: ${pc5.cyan("one connection list")} to see all connections.`,
+Try: ${pc6.cyan("one connection list")} to see all connections.`,
           "No Results"
         );
       } else {
         p4.note(
           `No connections yet.
 
-Add one with: ${pc5.cyan("one connection add gmail")}`,
+Add one with: ${pc6.cyan("one connection add gmail")}`,
           "No Connections"
         );
       }
@@ -2427,9 +2869,9 @@ Add one with: ${pc5.cyan("one connection add gmail")}`,
         { key: "status", label: "" },
         { key: "platform", label: "Platform" },
         { key: "state", label: "Status" },
-        { key: "key", label: "Connection Key", color: pc5.dim },
-        ...hasTags ? [{ key: "tags", label: "Tags", color: pc5.dim }] : [],
-        ...hasScopedAccess ? [{ key: "access", label: "Access", color: pc5.yellow }] : []
+        { key: "key", label: "Connection Key", color: pc6.dim },
+        ...hasTags ? [{ key: "tags", label: "Tags", color: pc6.dim }] : [],
+        ...hasScopedAccess ? [{ key: "access", label: "Access", color: pc6.yellow }] : []
       ],
       rows
     );
@@ -2443,7 +2885,7 @@ Add one with: ${pc5.cyan("one connection add gmail")}`,
       }
       p4.note(`${wrapText(lines.join("\n"))}
 
-Change it with: ${pc5.cyan("one config")}`, "Access");
+Change it with: ${pc6.cyan("one config")}`, "Access");
     }
     if (displayed.length < filtered.length) {
       p4.note(
@@ -2451,10 +2893,10 @@ Change it with: ${pc5.cyan("one config")}`, "Access");
         "Limited"
       );
     } else {
-      p4.note(`Add more with: ${pc5.cyan("one connection add <platform>")}`, "Tip");
+      p4.note(`Add more with: ${pc6.cyan("one connection add <platform>")}`, "Tip");
     }
   } catch (error2) {
-    spinner5.stop("Failed to load connections");
+    spinner4.stop("Failed to load connections");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
@@ -2464,13 +2906,13 @@ async function connectionDeleteCommand(connectionKey, options) {
     error("Not configured. Run `one init` first.");
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Finding connection...");
+  const spinner4 = createSpinner();
+  spinner4.start("Finding connection...");
   let allConnections;
   try {
     allConnections = await api.listConnections();
   } catch (error2) {
-    spinner5.stop("Failed to load connections");
+    spinner4.stop("Failed to load connections");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
     return;
   }
@@ -2479,15 +2921,15 @@ async function connectionDeleteCommand(connectionKey, options) {
   const connections = allowedKeys.includes("*") ? allConnections : allConnections.filter((conn) => allowedKeys.includes(conn.key));
   const match = connections.find((conn) => conn.key === connectionKey);
   if (!match) {
-    spinner5.stop("Connection not found");
+    spinner4.stop("Connection not found");
     error(`No connection found with key: ${connectionKey}`);
     return;
   }
   const connection2 = match;
-  spinner5.stop(`Found ${connection2.platform} (${connection2.state})`);
+  spinner4.stop(`Found ${connection2.platform} (${connection2.state})`);
   if (!isAgentMode() && !options?.force) {
     console.log();
-    console.log(`  ${getStatusIndicator(connection2.state)} ${connection2.platform}  ${pc5.dim(connection2.key)}`);
+    console.log(`  ${getStatusIndicator(connection2.state)} ${connection2.platform}  ${pc6.dim(connection2.key)}`);
     console.log();
     const confirmed = await p4.confirm({
       message: "Are you sure you want to delete this connection?",
@@ -2511,7 +2953,7 @@ async function connectionDeleteCommand(connectionKey, options) {
       });
       return;
     }
-    p4.log.success(`${pc5.green("\u2713")} ${connection2.platform} connection removed.`);
+    p4.log.success(`${pc6.green("\u2713")} ${connection2.platform} connection removed.`);
   } catch (error2) {
     deleteSpinner.stop("Failed to delete connection");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
@@ -2551,19 +2993,19 @@ function wrapText(text5, width = 72) {
 function getStatusIndicator(state) {
   switch (state) {
     case "operational":
-      return pc5.green("\u25CF");
+      return pc6.green("\u25CF");
     case "degraded":
-      return pc5.yellow("\u25CF");
+      return pc6.yellow("\u25CF");
     case "failed":
-      return pc5.red("\u25CF");
+      return pc6.red("\u25CF");
     default:
-      return pc5.dim("\u25CB");
+      return pc6.dim("\u25CB");
   }
 }
 
 // src/commands/platforms.ts
 import * as p5 from "@clack/prompts";
-import pc6 from "picocolors";
+import pc7 from "picocolors";
 async function platformsCommand(options) {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -2573,11 +3015,11 @@ async function platformsCommand(options) {
     options.json = true;
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading platforms...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading platforms...");
   try {
     const platforms = await api.listPlatforms();
-    spinner5.stop(`${platforms.length} platforms available`);
+    spinner4.stop(`${platforms.length} platforms available`);
     let filtered = platforms;
     if (options.category) {
       filtered = platforms.filter((plat) => (plat.category || "Other") === options.category);
@@ -2629,16 +3071,16 @@ async function platformsCommand(options) {
       );
     }
     console.log();
-    p5.note(`Connect with: ${pc6.cyan("one connection add <platform>")}`, "Tip");
+    p5.note(`Connect with: ${pc7.cyan("one connection add <platform>")}`, "Tip");
   } catch (error2) {
-    spinner5.stop("Failed to load platforms");
+    spinner4.stop("Failed to load platforms");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 
 // src/commands/actions.ts
 import * as p6 from "@clack/prompts";
-import pc7 from "picocolors";
+import pc8 from "picocolors";
 function getConfig() {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -2659,11 +3101,11 @@ function parseJsonArg2(value, argName) {
   }
 }
 async function actionsSearchCommand(platform, query, options) {
-  intro(pc7.bgCyan(pc7.black(" One ")));
+  intro(pc8.bgCyan(pc8.black(" One ")));
   const { apiKey, permissions, actionIds, knowledgeAgent } = getConfig();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start(`Searching actions on ${pc7.cyan(platform)} for "${query}"...`);
+  const spinner4 = createSpinner();
+  spinner4.start(`Searching actions on ${pc8.cyan(platform)} for "${query}"...`);
   try {
     const agentType = knowledgeAgent ? "knowledge" : options.type || "execute";
     const useCache = options.cache !== false;
@@ -2729,14 +3171,14 @@ async function actionsSearchCommand(platform, query, options) {
       return;
     }
     if (cleanedActions.length === 0) {
-      spinner5.stop("No actions found");
+      spinner4.stop("No actions found");
       p6.note(
         `No actions found for platform '${platform}' matching query '${query}'.
 
 Suggestions:
   - Try a more general query (e.g., 'list', 'get', 'search', 'create')
   - Verify the platform name is correct
-  - Check available platforms with ${pc7.cyan("one platforms")}
+  - Check available platforms with ${pc8.cyan("one platforms")}
 
 Examples of good queries:
   - "search contacts"
@@ -2747,7 +3189,7 @@ Examples of good queries:
       );
       return;
     }
-    spinner5.stop(
+    spinner4.stop(
       `Found ${cleanedActions.length} action(s) for '${platform}' matching '${query}'`
     );
     console.log();
@@ -2761,19 +3203,19 @@ Examples of good queries:
       [
         { key: "method", label: "Method" },
         { key: "title", label: "Title" },
-        { key: "actionId", label: "Action ID", color: pc7.dim },
-        { key: "path", label: "Path", color: pc7.dim }
+        { key: "actionId", label: "Action ID", color: pc8.dim },
+        { key: "path", label: "Path", color: pc8.dim }
       ],
       rows
     );
     console.log();
     p6.note(
-      `Get details: ${pc7.cyan(`one actions knowledge ${platform} <actionId>`)}
-Execute:     ${pc7.cyan(`one actions execute ${platform} <actionId> <connectionKey>`)}`,
+      `Get details: ${pc8.cyan(`one actions knowledge ${platform} <actionId>`)}
+Execute:     ${pc8.cyan(`one actions execute ${platform} <actionId> <connectionKey>`)}`,
       "Next Steps"
     );
   } catch (error2) {
-    spinner5.stop("Search failed");
+    spinner4.stop("Search failed");
     error(
       `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
     );
@@ -2802,32 +3244,32 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
     }
     return;
   }
-  intro(pc7.bgCyan(pc7.black(" One ")));
+  intro(pc8.bgCyan(pc8.black(" One ")));
   const { apiKey, actionIds, connectionKeys } = getConfig();
   const api = new OneApi(apiKey, getApiBase());
   if (!isActionAllowed(actionId, actionIds)) {
     error(`Action "${actionId}" is not in the allowed action list.`);
   }
   if (!connectionKeys.includes("*")) {
-    const spinner6 = createSpinner();
-    spinner6.start("Checking connections...");
+    const spinner5 = createSpinner();
+    spinner5.start("Checking connections...");
     try {
       const connections = await api.listConnections();
       const connectedPlatforms = connections.map((c) => c.platform);
       if (!connectedPlatforms.includes(platform)) {
-        spinner6.stop("Platform not connected");
+        spinner5.stop("Platform not connected");
         error(`Platform "${platform}" has no allowed connections.`);
       }
-      spinner6.stop("Connection verified");
+      spinner5.stop("Connection verified");
     } catch (error2) {
-      spinner6.stop("Failed to check connections");
+      spinner5.stop("Failed to check connections");
       error(
         `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
       );
     }
   }
-  const spinner5 = createSpinner();
-  spinner5.start(`Loading knowledge for action ${pc7.dim(actionId)}...`);
+  const spinner4 = createSpinner();
+  spinner4.start(`Loading knowledge for action ${pc8.dim(actionId)}...`);
   try {
     const { details, cacheHit, entry } = await resolveActionDetails(api, actionId, {
       useCache: options.cache !== false
@@ -2851,23 +3293,23 @@ async function actionsKnowledgeCommand(platform, actionId, options) {
       json(response);
       return;
     }
-    spinner5.stop("Knowledge loaded");
+    spinner4.stop("Knowledge loaded");
     console.log();
     console.log(knowledgeWithGuidance);
     console.log();
     p6.note(
-      `Execute: ${pc7.cyan(`one actions execute ${platform} ${actionId} <connectionKey>`)}`,
+      `Execute: ${pc8.cyan(`one actions execute ${platform} ${actionId} <connectionKey>`)}`,
       "Next Step"
     );
   } catch (error2) {
-    spinner5.stop("Failed to load knowledge");
+    spinner4.stop("Failed to load knowledge");
     error(
       `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
     );
   }
 }
 async function actionsExecuteCommand(platform, actionId, connectionKey, options) {
-  intro(pc7.bgCyan(pc7.black(" One ")));
+  intro(pc8.bgCyan(pc8.black(" One ")));
   const { apiKey, permissions, actionIds, connectionKeys, knowledgeAgent } = getConfig();
   if (knowledgeAgent) {
     error(
@@ -2881,18 +3323,18 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
     error(`Connection key "${connectionKey}" is not allowed.`);
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Resolving action details...");
+  const spinner4 = createSpinner();
+  spinner4.start("Resolving action details...");
   try {
     const { details: actionDetails, cacheHit: preflightCacheHit } = await resolveActionDetails(api, actionId, { useCache: options.cache !== false });
     if (!isMethodAllowed(actionDetails.method, permissions)) {
-      spinner5.stop("Permission denied");
+      spinner4.stop("Permission denied");
       error(
         `Method "${actionDetails.method}" is not allowed under "${permissions}" permission level.`
       );
     }
-    spinner5.stop(
-      `Action: ${actionDetails.title} [${actionDetails.method}]` + (preflightCacheHit ? pc7.dim(" (cached)") : "")
+    spinner4.stop(
+      `Action: ${actionDetails.title} [${actionDetails.method}]` + (preflightCacheHit ? pc8.dim(" (cached)") : "")
     );
     const data = options.data ? parseJsonArg2(options.data, "--data") : void 0;
     const pathVariables = options.pathVars ? parseJsonArg2(options.pathVars, "--path-vars") : void 0;
@@ -2901,7 +3343,7 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
     if (!options.skipValidation) {
       const validation = validateActionInput(actionDetails, { data, pathVariables, queryParams });
       if (!validation.valid) {
-        spinner5.stop("Validation failed");
+        spinner4.stop("Validation failed");
         if (isAgentMode()) {
           json({
             error: "Validation failed: missing required parameters",
@@ -2912,9 +3354,9 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
         }
         console.log();
         for (const m of validation.missing) {
-          console.log(pc7.red(`  ${m.flag} is missing "${m.param}"`));
+          console.log(pc8.red(`  ${m.flag} is missing "${m.param}"`));
           if (m.description) {
-            console.log(pc7.dim(`    ${m.description}`));
+            console.log(pc8.dim(`    ${m.description}`));
           }
         }
         console.log();
@@ -2922,7 +3364,7 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
       }
     }
     if (options.mock) {
-      spinner5.stop("Mock \u2014 returning example response");
+      spinner4.stop("Mock \u2014 returning example response");
       const mockResponse = actionDetails.ioSchema?.ioExample?.output ?? null;
       if (isAgentMode()) {
         json({
@@ -2939,7 +3381,7 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
       }
       console.log();
       if (mockResponse) {
-        console.log(pc7.bold("Mock Response:"));
+        console.log(pc8.bold("Mock Response:"));
         console.log(JSON.stringify(mockResponse, null, 2));
       } else {
         note("No example output available for this action", "Mock");
@@ -2980,33 +3422,33 @@ async function actionsExecuteCommand(platform, actionId, connectionKey, options)
       return;
     }
     console.log();
-    console.log(pc7.dim("Request:"));
+    console.log(pc8.dim("Request:"));
     console.log(
-      pc7.dim(
+      pc8.dim(
         `  ${result.requestConfig.method} ${result.requestConfig.url}`
       )
     );
     if (options.dryRun) {
       if (result.requestConfig.data) {
         console.log();
-        console.log(pc7.dim("Body:"));
-        console.log(pc7.dim(JSON.stringify(result.requestConfig.data, null, 2)));
+        console.log(pc8.dim("Body:"));
+        console.log(pc8.dim(JSON.stringify(result.requestConfig.data, null, 2)));
       }
       console.log();
       note("Dry run \u2014 request was not sent", "Dry Run");
     } else {
       console.log();
-      console.log(pc7.bold("Response:"));
+      console.log(pc8.bold("Response:"));
       const rd = result.responseData;
       if (rd && typeof rd === "object" && typeof rd.text === "string" && "contentType" in rd) {
-        if (rd.contentType) console.log(pc7.dim(`(${rd.contentType})`));
+        if (rd.contentType) console.log(pc8.dim(`(${rd.contentType})`));
         console.log(rd.text);
       } else {
         console.log(JSON.stringify(result.responseData, null, 2));
       }
     }
   } catch (error2) {
-    spinner5.stop("Execution failed");
+    spinner4.stop("Execution failed");
     error(
       `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
     );
@@ -3203,7 +3645,7 @@ async function actionsExecuteParallelCommand() {
     }
     console.log();
     for (const e of errors) {
-      console.log(`  ${pc7.red("\u2717")} Segment ${e.segment} (${e.label}):`);
+      console.log(`  ${pc8.red("\u2717")} Segment ${e.segment} (${e.label}):`);
       for (const msg of e.messages) {
         console.log(`    ${msg}`);
       }
@@ -3298,17 +3740,17 @@ async function actionsExecuteParallelCommand() {
   console.log();
   for (const r of results) {
     const label = `${r.platform}/${r.actionId}`;
-    const time = pc7.dim(`(${(r.durationMs / 1e3).toFixed(2)}s)`);
+    const time = pc8.dim(`(${(r.durationMs / 1e3).toFixed(2)}s)`);
     if (r.mock) {
-      console.log(`  [${r.segment}/${total}] ${label} ${pc7.cyan("\u25C7 mock")} ${time}`);
-      if (r.response) console.log(`  ${pc7.dim(JSON.stringify(r.response, null, 2).split("\n").join("\n  "))}`);
+      console.log(`  [${r.segment}/${total}] ${label} ${pc8.cyan("\u25C7 mock")} ${time}`);
+      if (r.response) console.log(`  ${pc8.dim(JSON.stringify(r.response, null, 2).split("\n").join("\n  "))}`);
     } else if (r.dryRun) {
-      console.log(`  [${r.segment}/${total}] ${label} ${pc7.yellow("\u2298 dry-run")} ${time}`);
+      console.log(`  [${r.segment}/${total}] ${label} ${pc8.yellow("\u2298 dry-run")} ${time}`);
     } else if (r.status === "success") {
-      console.log(`  [${r.segment}/${total}] ${label} ${pc7.green("\u2713")} ${time}`);
-      if (r.response) console.log(`  ${pc7.dim(JSON.stringify(r.response, null, 2).split("\n").join("\n  "))}`);
+      console.log(`  [${r.segment}/${total}] ${label} ${pc8.green("\u2713")} ${time}`);
+      if (r.response) console.log(`  ${pc8.dim(JSON.stringify(r.response, null, 2).split("\n").join("\n  "))}`);
     } else {
-      console.log(`  [${r.segment}/${total}] ${label} ${pc7.red("\u2717")} ${time} \u2014 ${r.error}`);
+      console.log(`  [${r.segment}/${total}] ${label} ${pc8.red("\u2717")} ${time} \u2014 ${r.error}`);
     }
   }
   console.log();
@@ -3323,26 +3765,26 @@ async function actionsExecuteParallelCommand() {
 function colorMethod(method) {
   switch (method.toUpperCase()) {
     case "GET":
-      return pc7.green(method);
+      return pc8.green(method);
     case "POST":
-      return pc7.yellow(method);
+      return pc8.yellow(method);
     case "PUT":
-      return pc7.blue(method);
+      return pc8.blue(method);
     case "PATCH":
-      return pc7.magenta(method);
+      return pc8.magenta(method);
     case "DELETE":
-      return pc7.red(method);
+      return pc8.red(method);
     default:
       return method;
   }
 }
 
 // src/commands/flow.ts
-import pc8 from "picocolors";
+import pc9 from "picocolors";
 
 // src/lib/flow-validator.ts
-import fs4 from "fs";
-import path5 from "path";
+import fs5 from "fs";
+import path6 from "path";
 import { spawnSync } from "child_process";
 function validateFlowSchema(flow2) {
   const errors = [];
@@ -3417,32 +3859,32 @@ function validateStepsArray(steps, pathPrefix, errors) {
   const validTypes = FLOW_SCHEMA.stepTypes.map((st) => st.type);
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
-    const path13 = `${pathPrefix}[${i}]`;
+    const path14 = `${pathPrefix}[${i}]`;
     if (!step || typeof step !== "object" || Array.isArray(step)) {
-      errors.push({ path: path13, message: "Step must be an object" });
+      errors.push({ path: path14, message: "Step must be an object" });
       continue;
     }
     const s = step;
     if (!s.id || typeof s.id !== "string") {
-      errors.push({ path: `${path13}.id`, message: 'Step must have a string "id"' });
+      errors.push({ path: `${path14}.id`, message: 'Step must have a string "id"' });
     }
     if (!s.name || typeof s.name !== "string") {
-      errors.push({ path: `${path13}.name`, message: 'Step must have a string "name"' });
+      errors.push({ path: `${path14}.name`, message: 'Step must have a string "name"' });
     }
     if (!s.type || !validTypes.includes(s.type)) {
-      errors.push({ path: `${path13}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
+      errors.push({ path: `${path14}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
       continue;
     }
     if (s.requires !== void 0) {
       if (!Array.isArray(s.requires)) {
-        errors.push({ path: `${path13}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
+        errors.push({ path: `${path14}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
       } else {
         for (let r = 0; r < s.requires.length; r++) {
           const sel = s.requires[r];
           if (typeof sel !== "string") {
-            errors.push({ path: `${path13}.requires[${r}]`, message: '"requires" entry must be a selector string' });
+            errors.push({ path: `${path14}.requires[${r}]`, message: '"requires" entry must be a selector string' });
           } else if (!sel.startsWith("$.")) {
-            errors.push({ path: `${path13}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
+            errors.push({ path: `${path14}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
           }
         }
       }
@@ -3450,7 +3892,7 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (s.onError && typeof s.onError === "object") {
       const oe = s.onError;
       if (!FLOW_SCHEMA.errorStrategies.includes(oe.strategy)) {
-        errors.push({ path: `${path13}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
+        errors.push({ path: `${path14}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
       }
     }
     const descriptor = getStepTypeDescriptor(s.type);
@@ -3460,14 +3902,14 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (!configObj || typeof configObj !== "object") {
       const hint = detectFlatConfigHint(s, descriptor);
       errors.push({
-        path: `${path13}.${configKey}`,
+        path: `${path14}.${configKey}`,
         message: `${capitalize(descriptor.type)} step must have a "${configKey}" config object${hint}`
       });
       continue;
     }
     const config2 = configObj;
     for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
-      const fieldPath = `${path13}.${configKey}.${fieldName}`;
+      const fieldPath = `${path14}.${configKey}.${fieldName}`;
       const value = config2[fieldName];
       if (fd.required && (value === void 0 || value === null || value === "")) {
         errors.push({ path: fieldPath, message: `${capitalize(descriptor.type)} must have ${fd.type === "string" ? "a string" : fd.type === "array" ? "a" : "a"} "${fieldName}"` });
@@ -3500,30 +3942,30 @@ function validateStepsArray(steps, pathPrefix, errors) {
       }
     }
     if (descriptor.type === "action") {
-      validateConnectionForm(config2, `${path13}.${configKey}`, errors);
+      validateConnectionForm(config2, `${path14}.${configKey}`, errors);
     }
     if (descriptor.type === "code") {
       const hasSource = typeof config2.source === "string" && config2.source.length > 0;
       const hasModule = typeof config2.module === "string" && config2.module.length > 0;
       if (!hasSource && !hasModule) {
-        errors.push({ path: `${path13}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
+        errors.push({ path: `${path14}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
       } else if (hasSource && hasModule) {
-        errors.push({ path: `${path13}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
+        errors.push({ path: `${path14}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
       }
       if (hasModule) {
         const m = config2.module;
         if (m.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(m)) {
-          errors.push({ path: `${path13}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
+          errors.push({ path: `${path14}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
         } else if (m.split(/[\\/]/).includes("..")) {
-          errors.push({ path: `${path13}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
+          errors.push({ path: `${path14}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
         } else if (!m.endsWith(".mjs")) {
-          errors.push({ path: `${path13}.${configKey}.module`, message: "Code module must be a .mjs file" });
+          errors.push({ path: `${path14}.${configKey}.module`, message: "Code module must be a .mjs file" });
         }
       }
       if (hasSource) {
         const syntaxError = checkCodeSourceSyntax(config2.source);
         if (syntaxError) {
-          errors.push({ path: `${path13}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
+          errors.push({ path: `${path14}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
         }
       }
     }
@@ -3595,16 +4037,16 @@ function validateStepIds(flow2) {
   function collectIds(steps, pathPrefix) {
     for (let i = 0; i < steps.length; i++) {
       const step = steps[i];
-      const path13 = `${pathPrefix}[${i}]`;
+      const path14 = `${pathPrefix}[${i}]`;
       if (seen.has(step.id)) {
-        errors.push({ path: `${path13}.id`, message: `Duplicate step ID: "${step.id}"` });
+        errors.push({ path: `${path14}.id`, message: `Duplicate step ID: "${step.id}"` });
       } else {
         seen.add(step.id);
       }
       for (const { configKey, fieldName } of nestedKeys) {
         const config2 = step[configKey];
         if (config2 && Array.isArray(config2[fieldName])) {
-          collectIds(config2[fieldName], `${path13}.${configKey}.${fieldName}`);
+          collectIds(config2[fieldName], `${path14}.${configKey}.${fieldName}`);
         }
       }
     }
@@ -3652,7 +4094,7 @@ function validateSelectorReferences(flow2, rootDir) {
     }
     return selectors;
   }
-  function checkSelectors(selectors, path13, precedingStepIds) {
+  function checkSelectors(selectors, path14, precedingStepIds) {
     for (const selector of selectors) {
       const parts = selector.split(".");
       if (parts.length < 3) continue;
@@ -3660,15 +4102,15 @@ function validateSelectorReferences(flow2, rootDir) {
       if (root === "input") {
         const inputName = parts[2];
         if (!inputNames.has(inputName)) {
-          errors.push({ path: path13, message: `Selector "${selector}" references undefined input "${inputName}"` });
+          errors.push({ path: path14, message: `Selector "${selector}" references undefined input "${inputName}"` });
         }
       } else if (root === "steps") {
         const stepId = parts[2].replace(/[\[\]]/g, "").split(/[\[\]]/)[0];
         if (!allStepIds.has(stepId)) {
-          errors.push({ path: path13, message: `Selector "${selector}" references undefined step "${stepId}"` });
+          errors.push({ path: path14, message: `Selector "${selector}" references undefined step "${stepId}"` });
         } else if (precedingStepIds && !precedingStepIds.has(stepId)) {
           errors.push({
-            path: path13,
+            path: path14,
             message: `Selector "${selector}" references step "${stepId}" which is declared after the current step. Steps execute in declaration order, so this will always resolve to undefined at runtime \u2014 move the dependency earlier in the steps array.`
           });
         }
@@ -3676,20 +4118,20 @@ function validateSelectorReferences(flow2, rootDir) {
     }
   }
   const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
-  function checkOperatorsInSelectorField(value, path13) {
+  function checkOperatorsInSelectorField(value, path14) {
     if (typeof value === "string" && value.startsWith("$.")) {
       if (value.includes("||")) {
-        errors.push({ path: path13, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+        errors.push({ path: path14, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
       } else if (value.includes("&&")) {
-        errors.push({ path: path13, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+        errors.push({ path: path14, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
       }
     } else if (value && typeof value === "object" && !Array.isArray(value)) {
       for (const [k, v] of Object.entries(value)) {
-        checkOperatorsInSelectorField(v, `${path13}.${k}`);
+        checkOperatorsInSelectorField(v, `${path14}.${k}`);
       }
     } else if (Array.isArray(value)) {
       for (let i = 0; i < value.length; i++) {
-        checkOperatorsInSelectorField(value[i], `${path13}[${i}]`);
+        checkOperatorsInSelectorField(value[i], `${path14}[${i}]`);
       }
     }
   }
@@ -3733,10 +4175,10 @@ function validateSelectorReferences(flow2, rootDir) {
           }
           const modulePath = step.type === "code" ? c.module : void 0;
           if (rootDir && typeof modulePath === "string" && modulePath.length > 0) {
-            const abs = path5.resolve(rootDir, modulePath);
-            if (fs4.existsSync(abs)) {
+            const abs = path6.resolve(rootDir, modulePath);
+            if (fs5.existsSync(abs)) {
               try {
-                const moduleText = fs4.readFileSync(abs, "utf-8");
+                const moduleText = fs5.readFileSync(abs, "utf-8");
                 checkSelectors(extractSelectors(moduleText), `${pathPrefix}.${descriptor.configKey}.module`, preceding2);
               } catch {
               }
@@ -3774,10 +4216,10 @@ var VALID_OUTPUT_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "bo
 function isOutputSchemaObject(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function walkOutputSchema(schema, path13) {
+function walkOutputSchema(schema, path14) {
   let current = schema;
-  for (let i = 0; i < path13.length; i++) {
-    const seg = path13[i];
+  for (let i = 0; i < path14.length; i++) {
+    const seg = path14[i];
     if (typeof current === "string") {
       return current === "unknown" || current === "object" || current === "array" ? "opaque" : "opaque";
     }
@@ -3929,8 +4371,8 @@ function validateCodeModules(flow2, rootDir) {
       const stepPath = `${pathPrefix}[${i}]`;
       if (step.type === "code" && step.code?.module) {
         const m = step.code.module;
-        const abs = path5.resolve(rootDir, m);
-        if (!fs4.existsSync(abs)) {
+        const abs = path6.resolve(rootDir, m);
+        if (!fs5.existsSync(abs)) {
           errors.push({
             path: `${stepPath}.code.module`,
             message: `Code module "${m}" not found at ${abs}`
@@ -4061,11 +4503,11 @@ function validateFileReadSchemas(flow2) {
 }
 
 // src/commands/flow.ts
-import fs5 from "fs";
-import path6 from "path";
+import fs6 from "fs";
+import path7 from "path";
 async function writeFlowResultFile(filePath, meta, steps) {
-  const abs = path6.resolve(filePath);
-  const ws = fs5.createWriteStream(abs);
+  const abs = path7.resolve(filePath);
+  const ws = fs6.createWriteStream(abs);
   const done = new Promise((resolve, reject) => {
     ws.on("finish", () => resolve());
     ws.on("error", reject);
@@ -4096,25 +4538,25 @@ function previewValue(value, max = 120) {
 }
 function renderDryRef(ref) {
   if (ref.status === "resolved") {
-    return `${pc8.green("\u2713")} ${ref.selector} ${pc8.dim("\u2192")} ${previewValue(ref.value)}`;
+    return `${pc9.green("\u2713")} ${ref.selector} ${pc9.dim("\u2192")} ${previewValue(ref.value)}`;
   }
   if (ref.status === "deferred") {
-    return `${pc8.dim("\u25CB")} ${ref.selector} ${pc8.dim("\u2192 pending (produced by a later step)")}`;
+    return `${pc9.dim("\u25CB")} ${ref.selector} ${pc9.dim("\u2192 pending (produced by a later step)")}`;
   }
-  return `${pc8.yellow("!")} ${ref.selector} ${pc8.yellow("\u2192 unresolved \u2014 check the input/env name")}`;
+  return `${pc9.yellow("!")} ${ref.selector} ${pc9.yellow("\u2192 unresolved \u2014 check the input/env name")}`;
 }
 function renderDryResolution(steps) {
   const isExpr = (t) => t === "transform" || t === "condition" || t === "while";
   for (const s of steps) {
-    const label = s.name ? `${s.stepId} ${pc8.dim(`"${s.name}"`)}` : s.stepId;
-    console.log(`  ${pc8.cyan("\u25B8")} ${label} ${pc8.dim(`(${s.type})`)}`);
+    const label = s.name ? `${s.stepId} ${pc9.dim(`"${s.name}"`)}` : s.stepId;
+    console.log(`  ${pc9.cyan("\u25B8")} ${label} ${pc9.dim(`(${s.type})`)}`);
     if (s.error !== void 0) {
-      console.log(`      ${pc8.red("error")} ${s.error}`);
+      console.log(`      ${pc9.red("error")} ${s.error}`);
     } else if (isExpr(s.type) && s.deferred) {
       const deps = s.references.map((r) => r.selector).join(", ");
-      console.log(`      ${pc8.dim("\u25CB pending \u2014 depends on")} ${deps} ${pc8.dim("(produced by a later step)")}`);
+      console.log(`      ${pc9.dim("\u25CB pending \u2014 depends on")} ${deps} ${pc9.dim("(produced by a later step)")}`);
     } else if (isExpr(s.type)) {
-      console.log(`      ${pc8.dim("=")} ${previewValue(s.resolved)}`);
+      console.log(`      ${pc9.dim("=")} ${previewValue(s.resolved)}`);
     }
     if (!(isExpr(s.type) && s.deferred)) {
       for (const ref of s.references) {
@@ -4122,7 +4564,7 @@ function renderDryResolution(steps) {
       }
     }
     if (!isExpr(s.type) && s.references.length === 0 && s.error === void 0) {
-      console.log(`      ${pc8.dim("(no interpolations)")}`);
+      console.log(`      ${pc9.dim("(no interpolations)")}`);
     }
   }
 }
@@ -4176,14 +4618,14 @@ async function autoResolveConnectionInputs(flow2, inputs, api) {
   return resolved;
 }
 async function flowCreateCommand(key, options) {
-  intro(pc8.bgCyan(pc8.black(" One Workflow ")));
+  intro(pc9.bgCyan(pc9.black(" One Workflow ")));
   let flow2;
   if (options.definition) {
     let raw = options.definition;
     if (raw.startsWith("@")) {
       const filePath = raw.slice(1);
       try {
-        raw = fs5.readFileSync(filePath, "utf-8");
+        raw = fs6.readFileSync(filePath, "utf-8");
       } catch (err) {
         error(`Cannot read file "${filePath}": ${err.message}`);
       }
@@ -4232,15 +4674,15 @@ ${errors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}`);
     return;
   }
   note(`Workflow "${flow2.name}" saved to ${flowPath}`, "Created");
-  outro(`Validate: ${pc8.cyan(`one flow validate ${flow2.key}`)}
-Execute:  ${pc8.cyan(`one flow execute ${flow2.key}`)}`);
+  outro(`Validate: ${pc9.cyan(`one flow validate ${flow2.key}`)}
+Execute:  ${pc9.cyan(`one flow execute ${flow2.key}`)}`);
 }
 async function flowExecuteCommand(keyOrPath, options) {
-  intro(pc8.bgCyan(pc8.black(" One Workflow ")));
+  intro(pc9.bgCyan(pc9.black(" One Workflow ")));
   const { apiKey, permissions, actionIds } = getConfig2();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start(`Loading workflow "${keyOrPath}"...`);
+  const spinner4 = createSpinner();
+  spinner4.start(`Loading workflow "${keyOrPath}"...`);
   let flow2;
   let rootDir;
   let flowFilePath;
@@ -4250,11 +4692,11 @@ async function flowExecuteCommand(keyOrPath, options) {
     rootDir = loaded.rootDir;
     flowFilePath = loaded.filePath;
   } catch (err) {
-    spinner5.stop("Workflow not found");
+    spinner4.stop("Workflow not found");
     error(err instanceof Error ? err.message : String(err));
     return;
   }
-  spinner5.stop(`Workflow: ${flow2.name} (${flow2.steps.length} steps)`);
+  spinner4.stop(`Workflow: ${flow2.name} (${flow2.steps.length} steps)`);
   const preflightErrors = validateFlow(flow2, rootDir);
   if (preflightErrors.length > 0) {
     if (isAgentMode()) {
@@ -4269,7 +4711,7 @@ ${preflightErrors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}`);
     if (isAgentMode()) {
       json({ event: "flow:deprecation", flowKey: flow2.key, warning: msg });
     } else {
-      console.error(pc8.yellow(`\u26A0 ${msg}`));
+      console.error(pc9.yellow(`\u26A0 ${msg}`));
     }
   }
   if (!options.allowBash && flowRequiresBash(flow2)) {
@@ -4303,7 +4745,7 @@ ${preflightErrors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}`);
     runner.requestPause();
     if (!isAgentMode()) {
       console.log(`
-${pc8.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
+${pc9.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
     }
   };
   process.on("SIGINT", sigintHandler);
@@ -4323,12 +4765,12 @@ ${pc8.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
     } else if (options.verbose) {
       const ts = (/* @__PURE__ */ new Date()).toISOString().split("T")[1].slice(0, 8);
       if (event.event === "step:start") {
-        console.log(`  ${pc8.dim(ts)} ${pc8.cyan("\u25B6")} ${event.stepName} ${pc8.dim(`(${event.type})`)}`);
+        console.log(`  ${pc9.dim(ts)} ${pc9.cyan("\u25B6")} ${event.stepName} ${pc9.dim(`(${event.type})`)}`);
       } else if (event.event === "step:complete") {
-        const status = event.status === "success" ? pc8.green("\u2713") : event.status === "skipped" ? pc8.dim("\u25CB") : pc8.red("\u2717");
-        console.log(`  ${pc8.dim(ts)} ${status} ${event.stepId} ${pc8.dim(`${event.durationMs}ms`)}`);
+        const status = event.status === "success" ? pc9.green("\u2713") : event.status === "skipped" ? pc9.dim("\u25CB") : pc9.red("\u2717");
+        console.log(`  ${pc9.dim(ts)} ${status} ${event.stepId} ${pc9.dim(`${event.durationMs}ms`)}`);
       } else if (event.event === "step:error") {
-        console.log(`  ${pc8.dim(ts)} ${pc8.red("\u2717")} ${event.stepId}: ${event.error}`);
+        console.log(`  ${pc9.dim(ts)} ${pc9.red("\u2717")} ${event.stepId}: ${event.error}`);
       }
     }
   };
@@ -4377,8 +4819,8 @@ ${pc8.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
       console.log();
       const missing = dryRunSteps.reduce((n, s) => n + s.references.filter((r) => r.status === "missing").length, 0);
       note(
-        `Dry run \u2014 no steps executed. Resolved ${dryRunSteps.length} step(s)` + (missing > 0 ? `; ${pc8.yellow(`${missing} unresolved input/env reference(s)`)}` : "") + `.
-${pc8.dim("$.steps.* refs resolve at runtime \u2014 re-run with --stop-after=<stepId> to resolve them against real output.")}`,
+        `Dry run \u2014 no steps executed. Resolved ${dryRunSteps.length} step(s)` + (missing > 0 ? `; ${pc9.yellow(`${missing} unresolved input/env reference(s)`)}` : "") + `.
+${pc9.dim("$.steps.* refs resolve at runtime \u2014 re-run with --stop-after=<stepId> to resolve them against real output.")}`,
         "Dry Run"
       );
       return;
@@ -4388,17 +4830,17 @@ ${pc8.dim("$.steps.* refs resolve at runtime \u2014 re-run with --stop-after=<st
     const failed = stepEntries.filter(([, r]) => r.status === "failed").length;
     const skipped = stepEntries.filter(([, r]) => r.status === "skipped").length;
     console.log();
-    console.log(`  ${pc8.green("\u2713")} ${succeeded} succeeded  ${failed > 0 ? pc8.red(`\u2717 ${failed} failed`) : ""}  ${skipped > 0 ? pc8.dim(`\u25CB ${skipped} skipped`) : ""}`);
-    console.log(`  ${pc8.dim(`Run ID: ${runId}`)}`);
-    console.log(`  ${pc8.dim(`Log: ${logPath}`)}`);
+    console.log(`  ${pc9.green("\u2713")} ${succeeded} succeeded  ${failed > 0 ? pc9.red(`\u2717 ${failed} failed`) : ""}  ${skipped > 0 ? pc9.dim(`\u25CB ${skipped} skipped`) : ""}`);
+    console.log(`  ${pc9.dim(`Run ID: ${runId}`)}`);
+    console.log(`  ${pc9.dim(`Log: ${logPath}`)}`);
     if (dryResolveTarget) {
       console.log();
-      console.log(`  ${pc8.dim(`Resolved (not executed) "${dryResolveTarget.stepId}":`)}`);
+      console.log(`  ${pc9.dim(`Resolved (not executed) "${dryResolveTarget.stepId}":`)}`);
       renderDryResolution([dryResolveTarget]);
     }
     if (stoppedAfter) {
       note(
-        `Stopped after step "${stoppedAfter}". Inspect step outputs with: ${pc8.cyan(`one flow inspect ${runId}`)}`,
+        `Stopped after step "${stoppedAfter}". Inspect step outputs with: ${pc9.cyan(`one flow inspect ${runId}`)}`,
         "Stopped"
       );
     } else if (options.dryRun) {
@@ -4420,13 +4862,13 @@ ${pc8.dim("$.steps.* refs resolve at runtime \u2014 re-run with --stop-after=<st
       });
       process.exit(1);
     }
-    console.log(`  ${pc8.dim(`Run ID: ${runId}`)}`);
-    console.log(`  ${pc8.dim(`Log: ${logPath}`)}`);
+    console.log(`  ${pc9.dim(`Run ID: ${runId}`)}`);
+    console.log(`  ${pc9.dim(`Log: ${logPath}`)}`);
     error(`Workflow failed: ${errorMsg}`);
   }
 }
 async function flowListCommand() {
-  intro(pc8.bgCyan(pc8.black(" One Workflow ")));
+  intro(pc9.bgCyan(pc9.black(" One Workflow ")));
   const flows = listFlows();
   if (isAgentMode()) {
     json({ workflows: flows });
@@ -4458,9 +4900,9 @@ async function flowListCommand() {
   console.log();
 }
 async function flowValidateCommand(keyOrPath) {
-  intro(pc8.bgCyan(pc8.black(" One Workflow ")));
-  const spinner5 = createSpinner();
-  spinner5.start(`Validating "${keyOrPath}"...`);
+  intro(pc9.bgCyan(pc9.black(" One Workflow ")));
+  const spinner4 = createSpinner();
+  spinner4.start(`Validating "${keyOrPath}"...`);
   let flowData;
   let rootDir;
   try {
@@ -4470,29 +4912,29 @@ async function flowValidateCommand(keyOrPath) {
       rootDir = loaded.rootDir;
     } catch {
       const flowPath = resolveFlowPath(keyOrPath);
-      const content = fs5.readFileSync(flowPath, "utf-8");
+      const content = fs6.readFileSync(flowPath, "utf-8");
       flowData = JSON.parse(content);
-      rootDir = path6.dirname(flowPath);
+      rootDir = path7.dirname(flowPath);
     }
   } catch (err) {
-    spinner5.stop("Validation failed");
+    spinner4.stop("Validation failed");
     error(`Could not read workflow: ${err instanceof Error ? err.message : String(err)}`);
   }
   const errors = validateFlow(flowData, rootDir);
   if (errors.length > 0) {
-    spinner5.stop("Validation failed");
+    spinner4.stop("Validation failed");
     if (isAgentMode()) {
       json({ valid: false, errors });
       process.exit(1);
     }
     console.log();
     for (const e of errors) {
-      console.log(`  ${pc8.red("\u2717")} ${pc8.dim(e.path)}: ${e.message}`);
+      console.log(`  ${pc9.red("\u2717")} ${pc9.dim(e.path)}: ${e.message}`);
     }
     console.log();
     error(`${errors.length} validation error(s) found`);
   }
-  spinner5.stop("Workflow is valid");
+  spinner4.stop("Workflow is valid");
   if (isAgentMode()) {
     json({ valid: true, key: flowData.key });
     return;
@@ -4500,7 +4942,7 @@ async function flowValidateCommand(keyOrPath) {
   note(`Workflow "${flowData.key}" passed all validation checks`, "Valid");
 }
 async function flowResumeCommand(runId, options = {}) {
-  intro(pc8.bgCyan(pc8.black(" One Workflow ")));
+  intro(pc9.bgCyan(pc9.black(" One Workflow ")));
   const state = FlowRunner.loadRunState(runId);
   if (!state) {
     error(`Run "${runId}" not found`);
@@ -4534,15 +4976,15 @@ async function flowResumeCommand(runId, options = {}) {
       json(event);
     }
   };
-  const spinner5 = createSpinner();
-  spinner5.start(`Resuming run ${runId} (${state.completedSteps.length} steps already completed)...`);
+  const spinner4 = createSpinner();
+  spinner4.start(`Resuming run ${runId} (${state.completedSteps.length} steps already completed)...`);
   try {
     const context = await runner.resume(flow2, api, permissions, actionIds, {
       onEvent,
       rootDir,
       allowBash: options.allowBash
     });
-    spinner5.stop("Workflow completed");
+    spinner4.stop("Workflow completed");
     if (isAgentMode()) {
       json({
         event: "workflow:result",
@@ -4553,10 +4995,10 @@ async function flowResumeCommand(runId, options = {}) {
       });
       return;
     }
-    console.log(`  ${pc8.green("\u2713")} Resumed and completed successfully`);
-    console.log(`  ${pc8.dim(`Log: ${runner.getLogPath()}`)}`);
+    console.log(`  ${pc9.green("\u2713")} Resumed and completed successfully`);
+    console.log(`  ${pc9.dim(`Log: ${runner.getLogPath()}`)}`);
   } catch (error2) {
-    spinner5.stop("Resume failed");
+    spinner4.stop("Resume failed");
     const errorMsg = error2 instanceof Error ? error2.message : String(error2);
     if (isAgentMode()) {
       json({ event: "workflow:result", runId, status: "failed", error: errorMsg });
@@ -4566,7 +5008,7 @@ async function flowResumeCommand(runId, options = {}) {
   }
 }
 async function flowRunsCommand(flowKey) {
-  intro(pc8.bgCyan(pc8.black(" One Workflow ")));
+  intro(pc9.bgCyan(pc9.black(" One Workflow ")));
   const runs = FlowRunner.listRuns(flowKey);
   if (isAgentMode()) {
     json({
@@ -4606,7 +5048,7 @@ async function flowRunsCommand(flowKey) {
   console.log();
 }
 async function flowInspectCommand(runId, options = {}) {
-  intro(pc8.bgCyan(pc8.black(" One Workflow ")));
+  intro(pc9.bgCyan(pc9.black(" One Workflow ")));
   const state = FlowRunner.loadRunState(runId);
   if (!state) {
     const msg = `No run found for id "${runId}". List runs with: one flow runs`;
@@ -4635,44 +5077,44 @@ async function flowInspectCommand(runId, options = {}) {
     return;
   }
   console.log();
-  console.log(`  ${pc8.bold(state.flowKey)} ${pc8.dim(`run ${state.runId}`)}  ${colorStatus(state.status)}`);
-  console.log(`  ${pc8.dim(`Started: ${state.startedAt}${state.completedAt ? `  \xB7  Ended: ${state.completedAt}` : ""}`)}`);
-  if (state.currentStepId) console.log(`  ${pc8.dim(`Current step: ${state.currentStepId}`)}`);
+  console.log(`  ${pc9.bold(state.flowKey)} ${pc9.dim(`run ${state.runId}`)}  ${colorStatus(state.status)}`);
+  console.log(`  ${pc9.dim(`Started: ${state.startedAt}${state.completedAt ? `  \xB7  Ended: ${state.completedAt}` : ""}`)}`);
+  if (state.currentStepId) console.log(`  ${pc9.dim(`Current step: ${state.currentStepId}`)}`);
   console.log();
   if (stepEntries.length === 0) {
     note("No step outputs recorded yet for this run.", "Steps");
   } else {
     for (const [id, result] of stepEntries) {
-      const icon = result.status === "success" ? pc8.green("\u2713") : result.status === "skipped" ? pc8.dim("\u25CB") : result.status === "timeout" ? pc8.yellow("\u29D6") : pc8.red("\u2717");
-      const dur = result.durationMs !== void 0 ? pc8.dim(` ${result.durationMs}ms`) : "";
-      const retries = result.retries ? pc8.dim(` (${result.retries} retr${result.retries === 1 ? "y" : "ies"})`) : "";
-      console.log(`  ${icon} ${id} ${pc8.dim(`[${result.status}]`)}${dur}${retries}`);
+      const icon = result.status === "success" ? pc9.green("\u2713") : result.status === "skipped" ? pc9.dim("\u25CB") : result.status === "timeout" ? pc9.yellow("\u29D6") : pc9.red("\u2717");
+      const dur = result.durationMs !== void 0 ? pc9.dim(` ${result.durationMs}ms`) : "";
+      const retries = result.retries ? pc9.dim(` (${result.retries} retr${result.retries === 1 ? "y" : "ies"})`) : "";
+      console.log(`  ${icon} ${id} ${pc9.dim(`[${result.status}]`)}${dur}${retries}`);
       if (result.error) {
-        console.log(`      ${pc8.red("error")} ${result.error}${result.errorCode ? pc8.dim(` (${result.errorCode})`) : ""}`);
+        console.log(`      ${pc9.red("error")} ${result.error}${result.errorCode ? pc9.dim(` (${result.errorCode})`) : ""}`);
       }
       if (result.output !== void 0) {
         const json2 = JSON.stringify(result.output, null, options.full ? 2 : 0) ?? String(result.output);
-        const shown = options.full || json2.length <= 240 ? json2 : `${json2.slice(0, 239)}\u2026  ${pc8.dim("(--full for all)")}`;
-        const indented = options.full ? shown.split("\n").map((l) => `        ${l}`).join("\n") : `      ${pc8.dim("output")} ${shown}`;
+        const shown = options.full || json2.length <= 240 ? json2 : `${json2.slice(0, 239)}\u2026  ${pc9.dim("(--full for all)")}`;
+        const indented = options.full ? shown.split("\n").map((l) => `        ${l}`).join("\n") : `      ${pc9.dim("output")} ${shown}`;
         console.log(indented);
       }
     }
   }
   console.log();
-  console.log(`  ${pc8.dim(`State: ${statePath}`)}`);
-  console.log(`  ${pc8.dim(`Log:   ${path6.join(".one/flows/.logs", `${state.flowKey}-${state.runId}.log`)}`)}`);
+  console.log(`  ${pc9.dim(`State: ${statePath}`)}`);
+  console.log(`  ${pc9.dim(`Log:   ${path7.join(".one/flows/.logs", `${state.flowKey}-${state.runId}.log`)}`)}`);
   console.log();
 }
 function colorStatus(status) {
   switch (status) {
     case "completed":
-      return pc8.green(status);
+      return pc9.green(status);
     case "running":
-      return pc8.cyan(status);
+      return pc9.cyan(status);
     case "paused":
-      return pc8.yellow(status);
+      return pc9.yellow(status);
     case "failed":
-      return pc8.red(status);
+      return pc9.red(status);
     default:
       return status;
   }
@@ -4850,7 +5292,7 @@ async function flowScaffoldCommand(template) {
 }
 
 // src/commands/relay.ts
-import pc9 from "picocolors";
+import pc10 from "picocolors";
 function getConfig3() {
   const apiKey = getApiKey();
   if (!apiKey) {
@@ -4873,8 +5315,8 @@ async function relayCreateCommand(options) {
     error(`Connection key "${options.connectionKey}" is not allowed.`);
   }
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Creating relay endpoint...");
+  const spinner4 = createSpinner();
+  spinner4.start("Creating relay endpoint...");
   try {
     const body = {
       connectionKey: options.connectionKey
@@ -4889,29 +5331,29 @@ async function relayCreateCommand(options) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint created");
+    spinner4.stop("Relay endpoint created");
     console.log();
-    console.log(`  ${pc9.dim("ID:")}          ${result.id}`);
-    console.log(`  ${pc9.dim("URL:")}         ${result.url}`);
-    console.log(`  ${pc9.dim("Active:")}      ${result.active}`);
-    if (result.description) console.log(`  ${pc9.dim("Description:")} ${result.description}`);
-    if (result.eventFilters?.length) console.log(`  ${pc9.dim("Events:")}      ${result.eventFilters.join(", ")}`);
-    if (result.webhookPayload?.id) console.log(`  ${pc9.dim("Webhook ID:")}  ${result.webhookPayload.id}`);
+    console.log(`  ${pc10.dim("ID:")}          ${result.id}`);
+    console.log(`  ${pc10.dim("URL:")}         ${result.url}`);
+    console.log(`  ${pc10.dim("Active:")}      ${result.active}`);
+    if (result.description) console.log(`  ${pc10.dim("Description:")} ${result.description}`);
+    if (result.eventFilters?.length) console.log(`  ${pc10.dim("Events:")}      ${result.eventFilters.join(", ")}`);
+    if (result.webhookPayload?.id) console.log(`  ${pc10.dim("Webhook ID:")}  ${result.webhookPayload.id}`);
     if (result.warning) {
       console.log();
-      console.log(`  ${pc9.yellow("\u26A0 Warning:")} ${result.warning}`);
+      console.log(`  ${pc10.yellow("\u26A0 Warning:")} ${result.warning}`);
     }
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to create relay endpoint");
+    spinner4.stop("Failed to create relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayListCommand(options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay endpoints...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading relay endpoints...");
   try {
     const query = {};
     if (options.limit) query.limit = options.limit;
@@ -4934,7 +5376,7 @@ async function relayListCommand(options) {
       });
       return;
     }
-    spinner5.stop(`${endpoints.length} relay endpoint${endpoints.length === 1 ? "" : "s"} found`);
+    spinner4.stop(`${endpoints.length} relay endpoint${endpoints.length === 1 ? "" : "s"} found`);
     if (endpoints.length === 0) {
       console.log("\n  No relay endpoints yet.\n");
       return;
@@ -4945,57 +5387,57 @@ async function relayListCommand(options) {
         { key: "description", label: "Description" },
         { key: "events", label: "Events" },
         { key: "actions", label: "Actions" },
-        { key: "id", label: "ID", color: pc9.dim }
+        { key: "id", label: "ID", color: pc10.dim }
       ],
       endpoints.map((e) => ({
-        status: e.active ? pc9.green("\u25CF") : pc9.dim("\u25CB"),
-        description: e.description || pc9.dim("(none)"),
-        events: e.eventFilters?.join(", ") || pc9.dim("all"),
+        status: e.active ? pc10.green("\u25CF") : pc10.dim("\u25CB"),
+        description: e.description || pc10.dim("(none)"),
+        events: e.eventFilters?.join(", ") || pc10.dim("all"),
         actions: String(e.actions?.length || 0),
         id: e.id.slice(0, 8)
       }))
     );
   } catch (error2) {
-    spinner5.stop("Failed to list relay endpoints");
+    spinner4.stop("Failed to list relay endpoints");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayGetCommand(id) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay endpoint...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading relay endpoint...");
   try {
     const result = await api.getRelayEndpoint(id);
     if (isAgentMode()) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint loaded");
+    spinner4.stop("Relay endpoint loaded");
     console.log();
-    console.log(`  ${pc9.dim("ID:")}          ${result.id}`);
-    console.log(`  ${pc9.dim("URL:")}         ${result.url}`);
-    console.log(`  ${pc9.dim("Active:")}      ${result.active}`);
-    if (result.description) console.log(`  ${pc9.dim("Description:")} ${result.description}`);
-    if (result.eventFilters?.length) console.log(`  ${pc9.dim("Events:")}      ${result.eventFilters.join(", ")}`);
-    console.log(`  ${pc9.dim("Actions:")}     ${result.actions?.length || 0}`);
+    console.log(`  ${pc10.dim("ID:")}          ${result.id}`);
+    console.log(`  ${pc10.dim("URL:")}         ${result.url}`);
+    console.log(`  ${pc10.dim("Active:")}      ${result.active}`);
+    if (result.description) console.log(`  ${pc10.dim("Description:")} ${result.description}`);
+    if (result.eventFilters?.length) console.log(`  ${pc10.dim("Events:")}      ${result.eventFilters.join(", ")}`);
+    console.log(`  ${pc10.dim("Actions:")}     ${result.actions?.length || 0}`);
     if (result.actions?.length) {
       for (const [i, action] of result.actions.entries()) {
-        console.log(`    ${pc9.dim(`[${i}]`)} type=${action.type}${action.actionId ? ` actionId=${action.actionId}` : ""}${action.url ? ` url=${action.url}` : ""}`);
+        console.log(`    ${pc10.dim(`[${i}]`)} type=${action.type}${action.actionId ? ` actionId=${action.actionId}` : ""}${action.url ? ` url=${action.url}` : ""}`);
       }
     }
-    console.log(`  ${pc9.dim("Created:")}     ${result.createdAt}`);
+    console.log(`  ${pc10.dim("Created:")}     ${result.createdAt}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to load relay endpoint");
+    spinner4.stop("Failed to load relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayUpdateCommand(id, options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Updating relay endpoint...");
+  const spinner4 = createSpinner();
+  spinner4.start("Updating relay endpoint...");
   try {
     const body = {};
     if (options.description !== void 0) body.description = options.description;
@@ -5008,40 +5450,40 @@ async function relayUpdateCommand(id, options) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint updated");
-    console.log(`  ${pc9.dim("ID:")} ${result.id}`);
-    console.log(`  ${pc9.dim("Active:")} ${result.active}`);
-    console.log(`  ${pc9.dim("Actions:")} ${result.actions?.length || 0}`);
+    spinner4.stop("Relay endpoint updated");
+    console.log(`  ${pc10.dim("ID:")} ${result.id}`);
+    console.log(`  ${pc10.dim("Active:")} ${result.active}`);
+    console.log(`  ${pc10.dim("Actions:")} ${result.actions?.length || 0}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to update relay endpoint");
+    spinner4.stop("Failed to update relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayDeleteCommand(id) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Deleting relay endpoint...");
+  const spinner4 = createSpinner();
+  spinner4.start("Deleting relay endpoint...");
   try {
     const result = await api.deleteRelayEndpoint(id);
     if (isAgentMode()) {
       json({ deleted: true, id: result.id });
       return;
     }
-    spinner5.stop("Relay endpoint deleted");
+    spinner4.stop("Relay endpoint deleted");
     console.log(`  Deleted: ${result.id}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to delete relay endpoint");
+    spinner4.stop("Failed to delete relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayActivateCommand(id, options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Activating relay endpoint...");
+  const spinner4 = createSpinner();
+  spinner4.start("Activating relay endpoint...");
   try {
     const actions2 = parseJsonArg3(options.actions, "--actions");
     const body = { actions: actions2 };
@@ -5051,21 +5493,21 @@ async function relayActivateCommand(id, options) {
       json(result);
       return;
     }
-    spinner5.stop("Relay endpoint activated");
-    console.log(`  ${pc9.dim("ID:")} ${result.id}`);
-    console.log(`  ${pc9.dim("Active:")} ${result.active}`);
-    console.log(`  ${pc9.dim("Actions:")} ${result.actions?.length || 0}`);
+    spinner4.stop("Relay endpoint activated");
+    console.log(`  ${pc10.dim("ID:")} ${result.id}`);
+    console.log(`  ${pc10.dim("Active:")} ${result.active}`);
+    console.log(`  ${pc10.dim("Actions:")} ${result.actions?.length || 0}`);
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to activate relay endpoint");
+    spinner4.stop("Failed to activate relay endpoint");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayEventsCommand(options) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay events...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading relay events...");
   try {
     const query = {};
     if (options.limit) query.limit = options.limit;
@@ -5089,7 +5531,7 @@ async function relayEventsCommand(options) {
       });
       return;
     }
-    spinner5.stop(`${events.length} event${events.length === 1 ? "" : "s"} found`);
+    spinner4.stop(`${events.length} event${events.length === 1 ? "" : "s"} found`);
     if (events.length === 0) {
       console.log("\n  No events found.\n");
       return;
@@ -5099,42 +5541,42 @@ async function relayEventsCommand(options) {
         { key: "platform", label: "Platform" },
         { key: "eventType", label: "Event Type" },
         { key: "timestamp", label: "Timestamp" },
-        { key: "id", label: "ID", color: pc9.dim }
+        { key: "id", label: "ID", color: pc10.dim }
       ],
       events.map((e) => ({
         platform: e.platform,
-        eventType: e.eventType || pc9.dim("unknown"),
+        eventType: e.eventType || pc10.dim("unknown"),
         timestamp: e.timestamp || e.createdAt,
         id: e.id.slice(0, 8)
       }))
     );
   } catch (error2) {
-    spinner5.stop("Failed to list relay events");
+    spinner4.stop("Failed to list relay events");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayEventGetCommand(id) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay event...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading relay event...");
   try {
     const result = await api.getRelayEvent(id);
     if (isAgentMode()) {
       json(result);
       return;
     }
-    spinner5.stop("Relay event loaded");
+    spinner4.stop("Relay event loaded");
     console.log();
-    console.log(`  ${pc9.dim("ID:")}        ${result.id}`);
-    console.log(`  ${pc9.dim("Platform:")}  ${result.platform}`);
-    console.log(`  ${pc9.dim("Event:")}     ${result.eventType}`);
-    console.log(`  ${pc9.dim("Timestamp:")} ${result.timestamp || result.createdAt}`);
-    console.log(`  ${pc9.dim("Payload:")}`);
+    console.log(`  ${pc10.dim("ID:")}        ${result.id}`);
+    console.log(`  ${pc10.dim("Platform:")}  ${result.platform}`);
+    console.log(`  ${pc10.dim("Event:")}     ${result.eventType}`);
+    console.log(`  ${pc10.dim("Timestamp:")} ${result.timestamp || result.createdAt}`);
+    console.log(`  ${pc10.dim("Payload:")}`);
     console.log(JSON.stringify(result.payload, null, 2));
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to load relay event");
+    spinner4.stop("Failed to load relay event");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
@@ -5144,8 +5586,8 @@ async function relayDeliveriesCommand(options) {
   }
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading deliveries...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading deliveries...");
   try {
     const deliveries = options.endpointId ? await api.listRelayEndpointDeliveries(options.endpointId) : await api.listRelayEventDeliveries(options.eventId);
     const items = Array.isArray(deliveries) ? deliveries : deliveries.rows || [];
@@ -5153,7 +5595,7 @@ async function relayDeliveriesCommand(options) {
       json({ deliveries: items });
       return;
     }
-    spinner5.stop(`${items.length} deliver${items.length === 1 ? "y" : "ies"} found`);
+    spinner4.stop(`${items.length} deliver${items.length === 1 ? "y" : "ies"} found`);
     if (items.length === 0) {
       console.log("\n  No deliveries found.\n");
       return;
@@ -5167,30 +5609,30 @@ async function relayDeliveriesCommand(options) {
         { key: "error", label: "Error" }
       ],
       items.map((d) => ({
-        status: d.status === "success" ? pc9.green(d.status) : pc9.red(d.status),
-        code: d.statusCode != null ? String(d.statusCode) : pc9.dim("-"),
+        status: d.status === "success" ? pc10.green(d.status) : pc10.red(d.status),
+        code: d.statusCode != null ? String(d.statusCode) : pc10.dim("-"),
         attempt: String(d.attempt),
-        deliveredAt: d.deliveredAt || pc9.dim("-"),
-        error: d.error ? pc9.red(d.error.slice(0, 50)) : pc9.dim("-")
+        deliveredAt: d.deliveredAt || pc10.dim("-"),
+        error: d.error ? pc10.red(d.error.slice(0, 50)) : pc10.dim("-")
       }))
     );
   } catch (error2) {
-    spinner5.stop("Failed to load deliveries");
+    spinner4.stop("Failed to load deliveries");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayPlatformsCommand() {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start("Loading relay-capable platforms...");
+  const spinner4 = createSpinner();
+  spinner4.start("Loading relay-capable platforms...");
   try {
     const platforms = await api.listRelayPlatforms();
     if (isAgentMode()) {
       json({ platforms });
       return;
     }
-    spinner5.stop(`${platforms.length} relay-capable platform${platforms.length === 1 ? "" : "s"} found`);
+    spinner4.stop(`${platforms.length} relay-capable platform${platforms.length === 1 ? "" : "s"} found`);
     if (platforms.length === 0) {
       console.log("\n  No relay-capable platforms available.\n");
       return;
@@ -5199,34 +5641,34 @@ async function relayPlatformsCommand() {
     printTable(
       [
         { key: "platform", label: "Platform" },
-        { key: "eventTypeCount", label: "Event types", color: pc9.dim }
+        { key: "eventTypeCount", label: "Event types", color: pc10.dim }
       ],
       platforms.map((p10) => ({ platform: p10.platform, eventTypeCount: String(p10.eventTypeCount) }))
     );
     console.log();
     console.log(
-      pc9.dim(
-        `  Run ${pc9.cyan("one relay event-types <platform>")} to see the full event list for a platform.
+      pc10.dim(
+        `  Run ${pc10.cyan("one relay event-types <platform>")} to see the full event list for a platform.
 `
       )
     );
   } catch (error2) {
-    spinner5.stop("Failed to load relay platforms");
+    spinner4.stop("Failed to load relay platforms");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
 async function relayEventTypesCommand(platform) {
   const { apiKey } = getConfig3();
   const api = new OneApi(apiKey, getApiBase());
-  const spinner5 = createSpinner();
-  spinner5.start(`Loading event types for ${pc9.cyan(platform)}...`);
+  const spinner4 = createSpinner();
+  spinner4.start(`Loading event types for ${pc10.cyan(platform)}...`);
   try {
     const eventTypes = await api.listRelayEventTypes(platform);
     if (isAgentMode()) {
       json({ platform, eventTypes });
       return;
     }
-    spinner5.stop(`${eventTypes.length} event type${eventTypes.length === 1 ? "" : "s"} found`);
+    spinner4.stop(`${eventTypes.length} event type${eventTypes.length === 1 ? "" : "s"} found`);
     if (eventTypes.length === 0) {
       console.log(`
   No event types found for ${platform}.
@@ -5239,7 +5681,7 @@ async function relayEventTypesCommand(platform) {
     }
     console.log();
   } catch (error2) {
-    spinner5.stop("Failed to load event types");
+    spinner4.stop("Failed to load event types");
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
@@ -5365,11 +5807,11 @@ function handleId(response, config2, records) {
 }
 
 // src/lib/memory/sync/state.ts
-import fs6 from "fs";
-import path7 from "path";
-var SYNC_DIR = path7.join(".one", "sync");
-var STATE_DIR = path7.join(SYNC_DIR, "state");
-var LEGACY_SINGLE_FILE = path7.join(SYNC_DIR, "sync_state.json");
+import fs7 from "fs";
+import path8 from "path";
+var SYNC_DIR = path8.join(".one", "sync");
+var STATE_DIR = path8.join(SYNC_DIR, "state");
+var LEGACY_SINGLE_FILE = path8.join(SYNC_DIR, "sync_state.json");
 var legacyMigrationDone = false;
 function rowToState(row) {
   return {
@@ -5397,9 +5839,9 @@ function stateToRow(platform, model, state, lastError) {
 async function migrateLegacyOnce() {
   if (legacyMigrationDone) return;
   legacyMigrationDone = true;
-  if (fs6.existsSync(LEGACY_SINGLE_FILE)) {
+  if (fs7.existsSync(LEGACY_SINGLE_FILE)) {
     try {
-      const raw = fs6.readFileSync(LEGACY_SINGLE_FILE, "utf-8");
+      const raw = fs7.readFileSync(LEGACY_SINGLE_FILE, "utf-8");
       const legacy = JSON.parse(raw);
       const backend = await getBackend();
       for (const [platform, models] of Object.entries(legacy)) {
@@ -5409,32 +5851,32 @@ async function migrateLegacyOnce() {
           await backend.setSyncState(stateToRow(platform, model, modelState));
         }
       }
-      fs6.unlinkSync(LEGACY_SINGLE_FILE);
+      fs7.unlinkSync(LEGACY_SINGLE_FILE);
     } catch {
       try {
-        fs6.unlinkSync(LEGACY_SINGLE_FILE);
+        fs7.unlinkSync(LEGACY_SINGLE_FILE);
       } catch {
       }
     }
   }
-  if (fs6.existsSync(STATE_DIR)) {
+  if (fs7.existsSync(STATE_DIR)) {
     try {
       const backend = await getBackend();
-      const platforms = fs6.readdirSync(STATE_DIR);
+      const platforms = fs7.readdirSync(STATE_DIR);
       for (const platform of platforms) {
-        const platformDir = path7.join(STATE_DIR, platform);
+        const platformDir = path8.join(STATE_DIR, platform);
         let entries;
         try {
-          entries = fs6.readdirSync(platformDir);
+          entries = fs7.readdirSync(platformDir);
         } catch {
           continue;
         }
         for (const entry of entries) {
           if (!entry.endsWith(".json")) continue;
           const model = entry.slice(0, -".json".length);
-          const filePath = path7.join(platformDir, entry);
+          const filePath = path8.join(platformDir, entry);
           try {
-            const raw = fs6.readFileSync(filePath, "utf-8");
+            const raw = fs7.readFileSync(filePath, "utf-8");
             const modelState = JSON.parse(raw);
             const existing = await backend.getSyncState(platform, model);
             if (!existing) {
@@ -5444,7 +5886,7 @@ async function migrateLegacyOnce() {
           }
         }
       }
-      fs6.rmSync(STATE_DIR, { recursive: true, force: true });
+      fs7.rmSync(STATE_DIR, { recursive: true, force: true });
     } catch {
     }
   }
@@ -5488,12 +5930,12 @@ async function removeModelState(platform, model) {
 }
 
 // src/lib/memory/sync/lock.ts
-import fs7 from "fs";
-import path8 from "path";
-var LOCK_DIR_REL = path8.join(".one", "sync", "locks");
+import fs8 from "fs";
+import path9 from "path";
+var LOCK_DIR_REL = path9.join(".one", "sync", "locks");
 var STALE_MS = 30 * 60 * 1e3;
 function lockPath(platform, model) {
-  return path8.join(LOCK_DIR_REL, `${platform}_${model}`);
+  return path9.join(LOCK_DIR_REL, `${platform}_${model}`);
 }
 function isProcessAlive(pid) {
   try {
@@ -5510,15 +5952,15 @@ var SyncLockError = class extends Error {
   }
 };
 function acquireSyncLock(platform, model) {
-  fs7.mkdirSync(LOCK_DIR_REL, { recursive: true });
+  fs8.mkdirSync(LOCK_DIR_REL, { recursive: true });
   const dir = lockPath(platform, model);
-  const pidFile = path8.join(dir, "pid");
+  const pidFile = path9.join(dir, "pid");
   try {
-    fs7.mkdirSync(dir);
+    fs8.mkdirSync(dir);
   } catch (err) {
     const stat = (() => {
       try {
-        return fs7.statSync(dir);
+        return fs8.statSync(dir);
       } catch {
         return null;
       }
@@ -5527,7 +5969,7 @@ function acquireSyncLock(platform, model) {
       const age = Date.now() - stat.mtimeMs;
       let ownerPid = null;
       try {
-        const raw = fs7.readFileSync(pidFile, "utf-8");
+        const raw = fs8.readFileSync(pidFile, "utf-8");
         const parsed = parseInt(raw.trim(), 10);
         if (!isNaN(parsed)) ownerPid = parsed;
       } catch {
@@ -5536,8 +5978,8 @@ function acquireSyncLock(platform, model) {
       const veryOld = age > STALE_MS;
       if (ownerDead || veryOld) {
         try {
-          fs7.rmSync(dir, { recursive: true, force: true });
-          fs7.mkdirSync(dir);
+          fs8.rmSync(dir, { recursive: true, force: true });
+          fs8.mkdirSync(dir);
         } catch {
           throw new SyncLockError(
             `Could not take over stale lock at ${dir}. Remove it manually if no sync is running.`
@@ -5554,13 +5996,13 @@ function acquireSyncLock(platform, model) {
     }
   }
   try {
-    fs7.writeFileSync(pidFile, String(process.pid));
+    fs8.writeFileSync(pidFile, String(process.pid));
   } catch {
   }
   return {
     release() {
       try {
-        fs7.rmSync(dir, { recursive: true, force: true });
+        fs8.rmSync(dir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -5569,9 +6011,9 @@ function acquireSyncLock(platform, model) {
 
 // src/lib/memory/sync/hooks.ts
 import { spawn as spawn2 } from "child_process";
-import fs8 from "fs";
-import path9 from "path";
-var EVENTS_DIR = path9.join(".one", "sync", "events");
+import fs9 from "fs";
+import path10 from "path";
+var EVENTS_DIR = path10.join(".one", "sync", "events");
 function classifyRecords(db, model, records, idField, tableExists2) {
   if (!tableExists2 || records.length === 0) {
     return { inserts: records, updates: [] };
@@ -5617,10 +6059,10 @@ async function fireHooks(hookCommand, events) {
 function appendEventLog(events) {
   if (events.length === 0) return;
   const { platform, model } = events[0];
-  fs8.mkdirSync(EVENTS_DIR, { recursive: true });
-  const logPath = path9.join(EVENTS_DIR, `${platform}_${model}.jsonl`);
+  fs9.mkdirSync(EVENTS_DIR, { recursive: true });
+  const logPath = path10.join(EVENTS_DIR, `${platform}_${model}.jsonl`);
   const lines = events.map((e) => JSON.stringify(e)).join("\n") + "\n";
-  fs8.appendFileSync(logPath, lines);
+  fs9.appendFileSync(logPath, lines);
 }
 function runShellHook(command, events) {
   return new Promise((resolve) => {
@@ -5724,8 +6166,8 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function interpolate(template, record) {
-  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path13) => {
-    const parts = path13.split(".");
+  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path14) => {
+    const parts = path14.split(".");
     let value = record;
     for (const part of parts) {
       if (typeof value !== "object" || value === null) return "";
@@ -5753,8 +6195,8 @@ function deepMerge(target, source) {
   }
   return result;
 }
-function getByDotPath2(obj, path13) {
-  const parts = path13.split(".");
+function getByDotPath2(obj, path14) {
+  const parts = path14.split(".");
   let current = obj;
   for (const part of parts) {
     if (current === null || current === void 0 || typeof current !== "object") return void 0;
@@ -5763,8 +6205,8 @@ function getByDotPath2(obj, path13) {
   return current;
 }
 function stripExcludedFields(obj, paths) {
-  for (const path13 of paths) {
-    stripOnePath(obj, path13.replace(/\[\]/g, ".*").split("."));
+  for (const path14 of paths) {
+    stripOnePath(obj, path14.replace(/\[\]/g, ".*").split("."));
   }
 }
 function stripOnePath(obj, parts) {
@@ -6185,8 +6627,8 @@ function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function stripFields(record, paths) {
-  for (const path13 of paths) {
-    stripOnePath2(record, path13.split("."));
+  for (const path14 of paths) {
+    stripOnePath2(record, path14.split("."));
   }
 }
 function stripOnePath2(obj, parts) {
@@ -6276,7 +6718,7 @@ async function syncModel(api, profile, options) {
         updateModelState(platform, model, { status: "failed", pagesProcessed, lastCursor }),
         (async () => {
           try {
-            const { getBackend: getBackend2 } = await import("./runtime-AFXLC4IC.js");
+            const { getBackend: getBackend2 } = await import("./runtime-65IPTPVD.js");
             const backend = await getBackend2();
             await Promise.race([
               backend.close(),
@@ -6642,7 +7084,7 @@ async function syncModel(api, profile, options) {
         db.exec(`DROP TABLE IF EXISTS _seen_ids`);
       }
       if (options.toMemory !== false) {
-        const backend = await (await import("./runtime-AFXLC4IC.js")).getBackend();
+        const backend = await (await import("./runtime-65IPTPVD.js")).getBackend();
         const type = `${platform}/${model}`;
         const existing = await backend.listKeysByType(type);
         const sourcePrefix = `${type}:`;
@@ -6743,7 +7185,7 @@ async function syncModel(api, profile, options) {
     let statusCounts;
     if (options.toMemory !== false) {
       try {
-        const backend = await (await import("./runtime-AFXLC4IC.js")).getBackend();
+        const backend = await (await import("./runtime-65IPTPVD.js")).getBackend();
         const typeName = `${platform}/${model}`;
         const [active, archived] = await Promise.all([
           backend.count(typeName, { status: "active" }),
@@ -7279,19 +7721,19 @@ function inferProfileFromKnowledge(knowledge, modelName, platform) {
 
 // src/lib/memory/sync/schedule.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import fs10 from "fs";
-import os from "os";
-import path11 from "path";
+import fs11 from "fs";
+import os2 from "os";
+import path12 from "path";
 
 // src/lib/memory/sync/schedule-registry.ts
-import fs9 from "fs";
-import path10 from "path";
-var REGISTRY_DIR = () => path10.join(homeDir(), ".one", "sync");
-var REGISTRY_FILE = () => path10.join(REGISTRY_DIR(), "schedules.json");
+import fs10 from "fs";
+import path11 from "path";
+var REGISTRY_DIR = () => path11.join(homeDir(), ".one", "sync");
+var REGISTRY_FILE = () => path11.join(REGISTRY_DIR(), "schedules.json");
 function readRaw() {
   try {
-    if (!fs9.existsSync(REGISTRY_FILE())) return { schedules: [] };
-    const raw = fs9.readFileSync(REGISTRY_FILE(), "utf-8");
+    if (!fs10.existsSync(REGISTRY_FILE())) return { schedules: [] };
+    const raw = fs10.readFileSync(REGISTRY_FILE(), "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed || !Array.isArray(parsed.schedules)) return { schedules: [] };
     return parsed;
@@ -7300,13 +7742,13 @@ function readRaw() {
   }
 }
 function writeRaw(file) {
-  fs9.mkdirSync(REGISTRY_DIR(), { recursive: true });
+  fs10.mkdirSync(REGISTRY_DIR(), { recursive: true });
   const tmp = REGISTRY_FILE() + ".tmp";
-  fs9.writeFileSync(tmp, JSON.stringify(file, null, 2));
-  fs9.renameSync(tmp, REGISTRY_FILE());
+  fs10.writeFileSync(tmp, JSON.stringify(file, null, 2));
+  fs10.renameSync(tmp, REGISTRY_FILE());
 }
 function makeScheduleId(platform, cwd) {
-  const slug = path10.basename(cwd).replace(/[^a-zA-Z0-9_-]/g, "-").toLowerCase();
+  const slug = path11.basename(cwd).replace(/[^a-zA-Z0-9_-]/g, "-").toLowerCase();
   return `${platform}-${slug}`;
 }
 function listRegistered() {
@@ -7340,7 +7782,7 @@ function removeRegistered(id) {
 
 // src/lib/memory/sync/schedule.ts
 var MARKER = "# one-sync";
-var LOG_DIR_REL = path11.join(".one", "sync", "logs");
+var LOG_DIR_REL = path12.join(".one", "sync", "logs");
 function durationToCron(every) {
   const match = every.match(/^(\d+)([mhd])$/);
   if (!match) return null;
@@ -7373,13 +7815,13 @@ function cronExprToDuration(expr) {
   return null;
 }
 function isWindows() {
-  return os.platform() === "win32";
+  return os2.platform() === "win32";
 }
 function resolveOneBinary() {
   try {
     const entry = process.argv[1];
-    if (entry && fs10.existsSync(entry)) {
-      return fs10.realpathSync(entry);
+    if (entry && fs11.existsSync(entry)) {
+      return fs11.realpathSync(entry);
     }
   } catch {
   }
@@ -7457,7 +7899,7 @@ function migrateLegacyCronEntries() {
     const modelsMatch = command.match(/--models\s+(\S+)/);
     const models = modelsMatch ? modelsMatch[1].split(",") : void 0;
     const logMatch = command.match(/>>\s+"([^"]+)"/);
-    const logFile = logMatch ? logMatch[1] : path11.resolve(cwd, LOG_DIR_REL, `${platform}.log`);
+    const logFile = logMatch ? logMatch[1] : path12.resolve(cwd, LOG_DIR_REL, `${platform}.log`);
     const id = makeScheduleId(platform, cwd);
     if (registeredIds.has(id)) continue;
     upsertRegistered({
@@ -7491,9 +7933,9 @@ function addSchedule(opts) {
   const cwd = process.cwd();
   const id = makeScheduleId(opts.platform, cwd);
   const replaced = getRegistered(id) !== void 0;
-  const logDir = path11.join(cwd, LOG_DIR_REL);
-  fs10.mkdirSync(logDir, { recursive: true });
-  const logFile = path11.join(logDir, `${opts.platform}.log`);
+  const logDir = path12.join(cwd, LOG_DIR_REL);
+  fs11.mkdirSync(logDir, { recursive: true });
+  const logFile = path12.join(logDir, `${opts.platform}.log`);
   const entry = {
     id,
     platform: opts.platform,
@@ -7547,15 +7989,15 @@ function removeSchedule(idOrPlatform, options) {
 function scheduleStatus() {
   const entries = listSchedules();
   return entries.map((entry) => {
-    const logExists = fs10.existsSync(entry.logFile);
-    const logSize = logExists ? fs10.statSync(entry.logFile).size : 0;
+    const logExists = fs11.existsSync(entry.logFile);
+    const logSize = logExists ? fs11.statSync(entry.logFile).size : 0;
     let logTail = [];
     let lastRunAt = null;
     if (logExists) {
       try {
-        lastRunAt = fs10.statSync(entry.logFile).mtime.toISOString();
+        lastRunAt = fs11.statSync(entry.logFile).mtime.toISOString();
         if (logSize > 0) {
-          const content = fs10.readFileSync(entry.logFile, "utf-8");
+          const content = fs11.readFileSync(entry.logFile, "utf-8");
           logTail = content.trim().split("\n").slice(-10);
         }
       } catch {
@@ -7563,8 +8005,8 @@ function scheduleStatus() {
     }
     let drift = "ok";
     if (!entry.cronInstalled) drift = "missing-cron";
-    else if (!fs10.existsSync(entry.nodeBin)) drift = "stale-node-bin";
-    else if (!fs10.existsSync(entry.cliBin)) drift = "stale-cli-bin";
+    else if (!fs11.existsSync(entry.nodeBin)) drift = "stale-node-bin";
+    else if (!fs11.existsSync(entry.cliBin)) drift = "stale-cli-bin";
     return { entry, logExists, logSize, logTail, lastRunAt, drift };
   });
 }
@@ -7837,11 +8279,11 @@ function isNoise(s) {
   if (/^-?\d+(\.\d+)?([eE][-+]?\d+)?$/.test(s)) return true;
   return false;
 }
-function recordSample(stats, path13, value, jsType, recordIndex, totalSamples) {
-  let s = stats.get(path13);
+function recordSample(stats, path14, value, jsType, recordIndex, totalSamples) {
+  let s = stats.get(path14);
   if (!s) {
     s = {
-      path: path13,
+      path: path14,
       total: totalSamples,
       recordIndices: /* @__PURE__ */ new Set(),
       lenSum: 0,
@@ -7850,7 +8292,7 @@ function recordSample(stats, path13, value, jsType, recordIndex, totalSamples) {
       primaryType: jsType,
       examples: []
     };
-    stats.set(path13, s);
+    stats.set(path14, s);
   }
   s.recordIndices.add(recordIndex);
   s.lenSum += value.length;
@@ -7859,28 +8301,28 @@ function recordSample(stats, path13, value, jsType, recordIndex, totalSamples) {
   if (s.primaryType !== jsType) s.primaryType = "mixed";
   if (s.examples.length < 3 && value.length < 200) s.examples.push(value);
 }
-function walkRecord(record, path13, stats, recordIndex, totalSamples) {
+function walkRecord(record, path14, stats, recordIndex, totalSamples) {
   if (record === null || record === void 0) return;
   if (typeof record === "string") {
     const trimmed = record.trim();
-    if (trimmed) recordSample(stats, path13, trimmed, "string", recordIndex, totalSamples);
+    if (trimmed) recordSample(stats, path14, trimmed, "string", recordIndex, totalSamples);
     return;
   }
   if (typeof record === "number" || typeof record === "boolean") {
     const str = String(record);
     const kind = typeof record === "number" ? "number" : "boolean";
-    if (str) recordSample(stats, path13, str, kind, recordIndex, totalSamples);
+    if (str) recordSample(stats, path14, str, kind, recordIndex, totalSamples);
     return;
   }
   if (Array.isArray(record)) {
-    const childPath = path13 ? `${path13}[]` : "[]";
+    const childPath = path14 ? `${path14}[]` : "[]";
     for (const item of record) walkRecord(item, childPath, stats, recordIndex, totalSamples);
     return;
   }
   if (typeof record === "object") {
     for (const [key, value] of Object.entries(record)) {
       if (key.startsWith("_")) continue;
-      const childPath = path13 ? `${path13}.${key}` : key;
+      const childPath = path14 ? `${path14}.${key}` : key;
       walkRecord(value, childPath, stats, recordIndex, totalSamples);
     }
   }
@@ -7918,7 +8360,7 @@ function suggestSearchablePaths(records, limit = 15) {
 // src/lib/memory/sync/index.ts
 import { spawn as spawn4 } from "child_process";
 import * as p7 from "@clack/prompts";
-import pc10 from "picocolors";
+import pc11 from "picocolors";
 async function syncInstallCommand() {
   if (await isSqliteAvailable()) {
     if (isAgentMode()) {
@@ -7983,15 +8425,15 @@ async function syncDoctorCommand() {
     return;
   }
   for (const c of checks) {
-    const mark = c.ok ? pc10.green("\u2713") : pc10.red("\u2717");
-    console.log(`  ${mark} ${c.name}${c.detail ? pc10.dim(` \u2014 ${c.detail}`) : ""}`);
+    const mark = c.ok ? pc11.green("\u2713") : pc11.red("\u2717");
+    console.log(`  ${mark} ${c.name}${c.detail ? pc11.dim(` \u2014 ${c.detail}`) : ""}`);
   }
   if (!allOk) {
     console.log(`
-${pc10.yellow("Sync is not ready.")} Try: ${pc10.bold("one sync install")}`);
+${pc11.yellow("Sync is not ready.")} Try: ${pc11.bold("one sync install")}`);
   } else {
     console.log(`
-${pc10.green("Sync is ready.")}`);
+${pc11.green("Sync is ready.")}`);
   }
 }
 function getApi() {
@@ -8034,19 +8476,19 @@ async function syncProfilesCommand(platform) {
     if (p10.enrich) extras.push("enrich");
     if (p10.identityKey || p10.identityKeys) extras.push("identity");
     if (p10.dateFilter) extras.push("incremental");
-    const tags = extras.length > 0 ? ` ${pc10.dim(`[${extras.join(", ")}]`)}` : "";
-    console.log(`  ${pc10.bold(`${p10.platform}/${p10.model}`.padEnd(35))} ${p10.description}${tags}`);
+    const tags = extras.length > 0 ? ` ${pc11.dim(`[${extras.join(", ")}]`)}` : "";
+    console.log(`  ${pc11.bold(`${p10.platform}/${p10.model}`.padEnd(35))} ${p10.description}${tags}`);
   }
   console.log(`
-${profiles.length} built-in profile(s). Run ${pc10.bold("one sync init <platform> <model>")} to use one.`);
+${profiles.length} built-in profile(s). Run ${pc11.bold("one sync init <platform> <model>")} to use one.`);
 }
 async function syncModelsCommand(platform) {
   const api = getApi();
-  const spinner5 = createSpinner();
-  spinner5.start(`Discovering models for ${platform}...`);
+  const spinner4 = createSpinner();
+  spinner4.start(`Discovering models for ${platform}...`);
   try {
     const models = await discoverModels(api, platform);
-    spinner5.stop(`Found ${models.length} models`);
+    spinner4.stop(`Found ${models.length} models`);
     if (isAgentMode()) {
       json({ platform, models, total: models.length });
       return;
@@ -8056,19 +8498,19 @@ async function syncModelsCommand(platform) {
       return;
     }
     const lines = models.map(
-      (m) => `  ${pc10.bold(m.name.padEnd(30))} ${pc10.dim(m.listAction.method)} ${pc10.dim(m.listAction.path)}`
+      (m) => `  ${pc11.bold(m.name.padEnd(30))} ${pc11.dim(m.listAction.method)} ${pc11.dim(m.listAction.path)}`
     );
     note(lines.join("\n"), `${platform} \u2014 ${models.length} models`);
   } catch (err) {
-    spinner5.stop("Failed");
+    spinner4.stop("Failed");
     error(`Error discovering models: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 async function syncInitCommand(platform, model, options) {
   if (!options.config) {
     const api = getApi();
-    const spinner5 = createSpinner();
-    spinner5.start(`Looking up ${platform}/${model}...`);
+    const spinner4 = createSpinner();
+    spinner4.start(`Looking up ${platform}/${model}...`);
     try {
       const models = await discoverModels(api, platform);
       const match = models.find((m) => m.name === model || m.name.toLowerCase() === model.toLowerCase());
@@ -8078,9 +8520,9 @@ async function syncInitCommand(platform, model, options) {
         if (actionId && !actionId.startsWith("conn_mod_def::")) {
           actionId = void 0;
         }
-        spinner5.stop(actionId ? "Found model + action ID" : "Found model (action ID not resolved)");
+        spinner4.stop(actionId ? "Found model + action ID" : "Found model (action ID not resolved)");
       } else {
-        spinner5.stop("Model not found in available actions");
+        spinner4.stop("Model not found in available actions");
       }
       const builtin = loadBuiltinProfile(platform, model);
       let template;
@@ -8160,15 +8602,15 @@ async function syncInitCommand(platform, model, options) {
         note(JSON.stringify(template, null, 2), "Sync profile template");
         if (inferred && inferred.reasoning.length > 0) {
           console.log(`
-${pc10.bold("Inferred from knowledge:")}`);
-          for (const r of inferred.reasoning) console.log(`  ${pc10.dim("\u2022")} ${r}`);
+${pc11.bold("Inferred from knowledge:")}`);
+          for (const r of inferred.reasoning) console.log(`  ${pc11.dim("\u2022")} ${r}`);
         }
         if (testReport) {
           console.log(`
-${pc10.bold("Test results:")}`);
+${pc11.bold("Test results:")}`);
           for (const c of testReport.checks) {
-            const mark = c.ok ? pc10.green("\u2713") : pc10.red("\u2717");
-            console.log(`  ${mark} ${c.name}${c.detail ? pc10.dim(` \u2014 ${c.detail}`) : ""}`);
+            const mark = c.ok ? pc11.green("\u2713") : pc11.red("\u2717");
+            console.log(`  ${mark} ${c.name}${c.detail ? pc11.dim(` \u2014 ${c.detail}`) : ""}`);
           }
         }
         console.log(`
@@ -8180,7 +8622,7 @@ Run with --config to save:
         }
       }
     } catch (err) {
-      spinner5.stop("Failed");
+      spinner4.stop("Failed");
       error(`Error: ${err instanceof Error ? err.message : String(err)}`);
     }
     return;
@@ -8251,17 +8693,17 @@ async function syncTestCommand(platformModel, options = {}) {
     return;
   }
   for (const c of report.checks) {
-    const mark = c.ok ? pc10.green("\u2713") : pc10.red("\u2717");
-    console.log(`  ${mark} ${c.name}${c.detail ? pc10.dim(` \u2014 ${c.detail}`) : ""}`);
+    const mark = c.ok ? pc11.green("\u2713") : pc11.red("\u2717");
+    console.log(`  ${mark} ${c.name}${c.detail ? pc11.dim(` \u2014 ${c.detail}`) : ""}`);
   }
   if (report.detectedColumns && report.detectedColumns.length > 0) {
     console.log(`
-  ${pc10.bold("Detected columns:")}`);
+  ${pc11.bold("Detected columns:")}`);
     for (const col of report.detectedColumns.slice(0, 20)) {
-      console.log(`    ${col.name.padEnd(30)} ${pc10.dim(col.type)}`);
+      console.log(`    ${col.name.padEnd(30)} ${pc11.dim(col.type)}`);
     }
     if (report.detectedColumns.length > 20) {
-      console.log(pc10.dim(`    ... and ${report.detectedColumns.length - 20} more`));
+      console.log(pc11.dim(`    ... and ${report.detectedColumns.length - 20} more`));
     }
   }
   if (report.identityKeysPreview) {
@@ -8269,45 +8711,45 @@ async function syncTestCommand(platformModel, options = {}) {
     const total = perRecord.reduce((a, b) => a + b, 0);
     const min = perRecord.length ? Math.min(...perRecord) : 0;
     const max = perRecord.length ? Math.max(...perRecord) : 0;
-    const mark = total === 0 ? pc10.yellow("~") : pc10.green("\u2713");
+    const mark = total === 0 ? pc11.yellow("~") : pc11.green("\u2713");
     console.log(`
-  ${pc10.bold("Merge + identity keys")} ${pc10.dim(`(cross-platform \u2014 #128)`)}`);
+  ${pc11.bold("Merge + identity keys")} ${pc11.dim(`(cross-platform \u2014 #128)`)}`);
     console.log(`    ${mark} ${perRecord.length} sample${perRecord.length === 1 ? "" : "s"}, ${min}\u2013${max} key${max === 1 ? "" : "s"} per record`);
     if (sampleKeys.length > 0) {
-      console.log(`    ${pc10.dim("e.g.")} ${sampleKeys.slice(0, 8).map((k) => pc10.cyan(k)).join(", ")}`);
+      console.log(`    ${pc11.dim("e.g.")} ${sampleKeys.slice(0, 8).map((k) => pc11.cyan(k)).join(", ")}`);
     } else if (resolvesAfterEnrich) {
-      console.log(`    ${pc10.dim("note:")} 0 on these list-shape samples \u2014 this profile enriches, and its identityKeys paths resolve in the enrich phase.`);
+      console.log(`    ${pc11.dim("note:")} 0 on these list-shape samples \u2014 this profile enriches, and its identityKeys paths resolve in the enrich phase.`);
     } else {
-      console.log(`    ${pc10.yellow("note:")} no identity keys resolved on these samples \u2014 check the identityKey/identityKeys paths.`);
+      console.log(`    ${pc11.yellow("note:")} no identity keys resolved on these samples \u2014 check the identityKey/identityKeys paths.`);
     }
     if (entityFanOut) {
-      console.log(`    ${pc10.yellow("warn:")} identityKey resolved to MULTIPLE values on ${entityFanOut.count} of ${perRecord.length} samples \u2014 those records get NO merge key.`);
-      console.log(`          ${pc10.dim("saw:")} ${entityFanOut.sampleValues.map((v) => pc10.cyan(v)).join(", ")}`);
-      console.log(`          ${pc10.dim('A singular identityKey means "this record IS this entity", so a fan-out has no safe answer.')}`);
-      console.log(`          ${pc10.dim("Point it at a single-valued path, or move it to identityKeys[] for participant associations.")}`);
+      console.log(`    ${pc11.yellow("warn:")} identityKey resolved to MULTIPLE values on ${entityFanOut.count} of ${perRecord.length} samples \u2014 those records get NO merge key.`);
+      console.log(`          ${pc11.dim("saw:")} ${entityFanOut.sampleValues.map((v) => pc11.cyan(v)).join(", ")}`);
+      console.log(`          ${pc11.dim('A singular identityKey means "this record IS this entity", so a fan-out has no safe answer.')}`);
+      console.log(`          ${pc11.dim("Point it at a single-valued path, or move it to identityKeys[] for participant associations.")}`);
     }
   }
   if (searchablePreview) {
     console.log(`
-  ${pc10.bold("Searchable preview")} ${pc10.dim(`(${searchablePreview.mode}, ${searchablePreview.sampledRecords} sample${searchablePreview.sampledRecords === 1 ? "" : "s"})`)}`);
-    console.log(`    ${pc10.dim("length:")}  ${searchablePreview.length} chars (first sample)`);
-    console.log(`    ${pc10.dim("text:")}    ${searchablePreview.text.slice(0, 300)}${searchablePreview.length > 300 ? pc10.dim(" \u2026") : ""}`);
+  ${pc11.bold("Searchable preview")} ${pc11.dim(`(${searchablePreview.mode}, ${searchablePreview.sampledRecords} sample${searchablePreview.sampledRecords === 1 ? "" : "s"})`)}`);
+    console.log(`    ${pc11.dim("length:")}  ${searchablePreview.length} chars (first sample)`);
+    console.log(`    ${pc11.dim("text:")}    ${searchablePreview.text.slice(0, 300)}${searchablePreview.length > 300 ? pc11.dim(" \u2026") : ""}`);
     if (searchablePreview.paths) {
-      console.log(`    ${pc10.dim("paths:")}  ${pc10.dim('(hit rate across all samples \u2014 differentiates "wrong path" from "field sometimes missing")')}`);
+      console.log(`    ${pc11.dim("paths:")}  ${pc11.dim('(hit rate across all samples \u2014 differentiates "wrong path" from "field sometimes missing")')}`);
       for (const p10 of searchablePreview.paths) {
         const rate = `${p10.hits}/${p10.total}`;
-        const mark = p10.hits === p10.total ? pc10.green("\u2713") : p10.hits === 0 ? pc10.red("\u2717") : pc10.yellow("~");
-        const trailer = p10.sample ? pc10.dim(` \u2192 "${p10.sample}"`) : p10.hits === 0 ? pc10.dim(" (no sample matched \u2014 typo, or field never populated in this page)") : "";
+        const mark = p10.hits === p10.total ? pc11.green("\u2713") : p10.hits === 0 ? pc11.red("\u2717") : pc11.yellow("~");
+        const trailer = p10.sample ? pc11.dim(` \u2192 "${p10.sample}"`) : p10.hits === 0 ? pc11.dim(" (no sample matched \u2014 typo, or field never populated in this page)") : "";
         console.log(`      ${mark} ${rate.padStart(5)} ${p10.path}${trailer}`);
       }
     } else {
-      console.log(`    ${pc10.yellow("note:")} no memory.searchable declared \u2014 using the default walker (walks every field, often noisy).`);
-      console.log(`    ${pc10.dim("tip:")}  run \`one sync suggest-searchable ${platform}/${model}\` for an auto-ranked starter list, or pick paths by hand and add them to profile.memory.searchable.`);
+      console.log(`    ${pc11.yellow("note:")} no memory.searchable declared \u2014 using the default walker (walks every field, often noisy).`);
+      console.log(`    ${pc11.dim("tip:")}  run \`one sync suggest-searchable ${platform}/${model}\` for an auto-ranked starter list, or pick paths by hand and add them to profile.memory.searchable.`);
     }
   }
   console.log(
     `
-${report.ok ? pc10.green("Profile looks good.") : pc10.red("Profile has issues.")} ` + (report.ok ? `Run: ${pc10.bold(`one sync run ${platform} --models ${model}`)}` : "Fix the issues above and test again.")
+${report.ok ? pc11.green("Profile looks good.") : pc11.red("Profile has issues.")} ` + (report.ok ? `Run: ${pc11.bold(`one sync run ${platform} --models ${model}`)}` : "Fix the issues above and test again.")
   );
 }
 function buildSearchablePreview(profile, samples) {
@@ -8315,7 +8757,7 @@ function buildSearchablePreview(profile, samples) {
   const first = samples[0];
   const paths = getSearchablePaths(profile);
   if (paths) {
-    const perPathAgg = paths.map((path13) => ({ path: path13, hits: 0, total: samples.length, sample: "" }));
+    const perPathAgg = paths.map((path14) => ({ path: path14, hits: 0, total: samples.length, sample: "" }));
     for (const record of samples) {
       const { paths: perPath } = extractSearchableFromPaths(record, paths);
       perPath.forEach((p10, i) => {
@@ -8348,8 +8790,8 @@ async function syncRunCommand(platform, options) {
   if (profileDrift.length > 0 && !isAgentMode()) {
     for (const d of profileDrift) {
       console.log(
-        `  ${pc10.yellow("!")} ${platform}/${d.model} is missing ${d.missing.map((f) => pc10.bold(f)).join(", ")} from the current built-in profile.
-    Run ${pc10.bold(`one sync init ${platform} ${d.model}`)} to pick ${d.missing.length > 1 ? "them" : "it"} up.`
+        `  ${pc11.yellow("!")} ${platform}/${d.model} is missing ${d.missing.map((f) => pc11.bold(f)).join(", ")} from the current built-in profile.
+    Run ${pc11.bold(`one sync init ${platform} ${d.model}`)} to pick ${d.missing.length > 1 ? "them" : "it"} up.`
       );
     }
   }
@@ -8392,21 +8834,21 @@ async function syncRunCommand(platform, options) {
     return;
   }
   for (const r of results) {
-    const status = r.status === "complete" ? pc10.green("complete") : r.status === "dry-run" ? pc10.yellow("dry-run") : pc10.red("failed");
-    console.log(`  ${pc10.bold(r.model)} \u2014 ${r.recordsSynced} records, ${r.pagesProcessed} pages, ${r.duration} [${status}]`);
+    const status = r.status === "complete" ? pc11.green("complete") : r.status === "dry-run" ? pc11.yellow("dry-run") : pc11.red("failed");
+    console.log(`  ${pc11.bold(r.model)} \u2014 ${r.recordsSynced} records, ${r.pagesProcessed} pages, ${r.duration} [${status}]`);
     if (r.reconcileSkipped) {
-      console.log(`    ${pc10.yellow("--full-refresh reconcile skipped \u2014 pagination truncated (e.g. --max-pages). Re-run without the cap to prune stale rows.")}`);
+      console.log(`    ${pc11.yellow("--full-refresh reconcile skipped \u2014 pagination truncated (e.g. --max-pages). Re-run without the cap to prune stale rows.")}`);
     }
     const sc = r.statusCounts;
     if (sc && (sc.archived > 0 || sc.active > 0)) {
-      const archivedColor = sc.archived > sc.active ? pc10.red : pc10.dim;
-      console.log(`    memory: ${pc10.green(String(sc.active))} active, ${archivedColor(String(sc.archived))} archived`);
+      const archivedColor = sc.archived > sc.active ? pc11.red : pc11.dim;
+      console.log(`    memory: ${pc11.green(String(sc.active))} active, ${archivedColor(String(sc.archived))} archived`);
     }
     if (r.error) {
       const errParts = [r.error.message];
       if (r.error.httpStatus) errParts.push(`HTTP ${r.error.httpStatus}`);
       if (r.error.retryAfter) errParts.push(`retry after ${r.error.retryAfter}s`);
-      console.log(`    ${pc10.red(errParts.join(" \u2014 "))}`);
+      console.log(`    ${pc11.red(errParts.join(" \u2014 "))}`);
     }
   }
 }
@@ -8432,8 +8874,8 @@ async function syncQueryCommand(platformModel, options) {
       json(result);
       return;
     }
-    console.log(pc10.dim(`Query: ${result.query}`));
-    console.log(pc10.dim(`Source: local | Last sync: ${result.lastSync ?? "never"} | Age: ${result.syncAge ?? "n/a"}`));
+    console.log(pc11.dim(`Query: ${result.query}`));
+    console.log(pc11.dim(`Source: local | Last sync: ${result.lastSync ?? "never"} | Age: ${result.syncAge ?? "n/a"}`));
     console.log(JSON.stringify(result.results, null, 2));
     console.log(`
 ${result.total} results`);
@@ -8455,7 +8897,7 @@ async function syncSearchCommand(query, options) {
       return;
     }
     for (const r of result.results) {
-      console.log(`  ${pc10.bold(`${r.platform}/${r.model}`)} ${pc10.dim(`(rank: ${r.rank.toFixed(2)})`)}`);
+      console.log(`  ${pc11.bold(`${r.platform}/${r.model}`)} ${pc11.dim(`(rank: ${r.rank.toFixed(2)})`)}`);
       console.log(`    ${JSON.stringify(r.record)}`);
     }
     console.log(`
@@ -8465,7 +8907,7 @@ ${result.total} results`);
   }
 }
 async function syncSqlCommand(platformModel, sql) {
-  const { syncSqlCommand: runSyncSql } = await import("./sql-3WNYRCWP.js");
+  const { syncSqlCommand: runSyncSql } = await import("./sql-QIVDWTL3.js");
   await runSyncSql(platformModel, sql);
 }
 async function syncDeleteCommand(platformModel, options) {
@@ -8543,7 +8985,7 @@ async function syncDeleteCommand(platformModel, options) {
 async function maybeAutoMigrateLegacy(platform, models) {
   const dbSize = getDatabaseSize(platform);
   if (!dbSize || dbSize === "0 B") return;
-  const { getBackend: getBackend2 } = await import("./runtime-AFXLC4IC.js");
+  const { getBackend: getBackend2 } = await import("./runtime-65IPTPVD.js");
   const backend = await getBackend2();
   let memoryHasData = false;
   for (const model of models) {
@@ -8559,7 +9001,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
       `  detected legacy .one/sync/data/${platform}.db (${dbSize}) \u2014 auto-migrating into memory before sync.
 `
     );
-    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-37A463L6.js");
+    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-IJI3BTWL.js");
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
@@ -8568,7 +9010,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
     initialValue: true
   });
   if (p7.isCancel(shouldMigrate) || !shouldMigrate) return;
-  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-37A463L6.js");
+  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-IJI3BTWL.js");
   await memMigrateCommand2({ platform, yes: true });
 }
 async function syncSuggestSearchableCommand(platformModel, options = {}) {
@@ -8606,30 +9048,30 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
     return;
   }
   console.log(`
-  ${pc10.bold("memory.searchable \u2014 ranked suggestions")} ${pc10.dim(`(${samples.length} samples)`)}`);
+  ${pc11.bold("memory.searchable \u2014 ranked suggestions")} ${pc11.dim(`(${samples.length} samples)`)}`);
   if (suggestions.length === 0) {
-    console.log(`    ${pc10.yellow("no high-signal leaves found")} \u2014 page may be all UUIDs / timestamps / enum markers. Inspect the sample with \`sync test\` and pick paths manually.`);
+    console.log(`    ${pc11.yellow("no high-signal leaves found")} \u2014 page may be all UUIDs / timestamps / enum markers. Inspect the sample with \`sync test\` and pick paths manually.`);
     return;
   }
   for (const s of suggestions) {
     const hitPct = Math.round(s.hitRate * 100);
     const noisePct = Math.round(s.noiseFraction * 100);
-    const noiseBadge = noisePct > 0 ? pc10.dim(` noise=${noisePct}%`) : "";
+    const noiseBadge = noisePct > 0 ? pc11.dim(` noise=${noisePct}%`) : "";
     console.log(
-      `    ${pc10.green(String(s.score).padStart(5))}  ${pc10.cyan(s.path.padEnd(52))}` + pc10.dim(` ${hitPct}% hit`) + pc10.dim(` avg=${s.avgLength}ch`) + noiseBadge + (s.sampleValue ? pc10.dim(`
+      `    ${pc11.green(String(s.score).padStart(5))}  ${pc11.cyan(s.path.padEnd(52))}` + pc11.dim(` ${hitPct}% hit`) + pc11.dim(` avg=${s.avgLength}ch`) + noiseBadge + (s.sampleValue ? pc11.dim(`
           \u2192 "${s.sampleValue.slice(0, 140)}"`) : "")
     );
   }
   console.log(`
-  ${pc10.bold("Paste-ready:")}`);
-  console.log("    " + pc10.cyan(`one sync init ${platform} ${model} --config '${JSON.stringify(configPatch)}'`));
+  ${pc11.bold("Paste-ready:")}`);
+  console.log("    " + pc11.cyan(`one sync init ${platform} ${model} --config '${JSON.stringify(configPatch)}'`));
   console.log(`
-  ${pc10.dim("then preview: ")}${pc10.cyan(`one sync test ${platform}/${model} --show-searchable`)}`);
+  ${pc11.dim("then preview: ")}${pc11.cyan(`one sync test ${platform}/${model} --show-searchable`)}`);
 }
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
   const state = await readSyncState();
-  const { getBackend: getBackend2 } = await import("./runtime-AFXLC4IC.js");
+  const { getBackend: getBackend2 } = await import("./runtime-65IPTPVD.js");
   const backend = await getBackend2();
   const syncs = await Promise.all(profiles.map(async (p10) => {
     const modelState = state[p10.platform]?.[p10.model];
@@ -8658,10 +9100,10 @@ async function syncListCommand(platform) {
     return;
   }
   for (const s of syncs) {
-    const status = s.status === "idle" ? pc10.green("idle") : s.status === "syncing" ? pc10.yellow(`syncing \u2014 page ${s.pagesProcessed}`) : pc10.red("failed");
-    const legacy = s.legacyDbSize && s.legacyDbSize !== "0 B" ? pc10.yellow(`  legacy .db ${s.legacyDbSize}`) : "";
+    const status = s.status === "idle" ? pc11.green("idle") : s.status === "syncing" ? pc11.yellow(`syncing \u2014 page ${s.pagesProcessed}`) : pc11.red("failed");
+    const legacy = s.legacyDbSize && s.legacyDbSize !== "0 B" ? pc11.yellow(`  legacy .db ${s.legacyDbSize}`) : "";
     console.log(
-      `  ${pc10.bold(`${s.platform}/${s.model}`.padEnd(35))} ${String(s.totalRecords).padStart(8)} records  ${status}  ${pc10.dim(s.lastSync ? `last: ${s.lastSync}` : "never synced")}` + legacy
+      `  ${pc11.bold(`${s.platform}/${s.model}`.padEnd(35))} ${String(s.totalRecords).padStart(8)} records  ${status}  ${pc11.dim(s.lastSync ? `last: ${s.lastSync}` : "never synced")}` + legacy
     );
   }
 }
@@ -8740,8 +9182,8 @@ async function syncScheduleAddCommand(platform, options) {
     }
     const verb = replaced ? "Replaced existing schedule" : "Scheduled sync";
     outro(
-      `${verb} ${pc10.bold(entry.id)} \u2014 every ${pc10.bold(entry.every)} (cron: ${pc10.dim(entry.cronExpr)})
-Logs: ${pc10.dim(entry.logFile)}`
+      `${verb} ${pc11.bold(entry.id)} \u2014 every ${pc11.bold(entry.every)} (cron: ${pc11.dim(entry.cronExpr)})
+Logs: ${pc11.dim(entry.logFile)}`
     );
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -8760,14 +9202,14 @@ async function syncScheduleListCommand() {
     }
     for (const e of entries) {
       const modelsStr = e.models ? ` [${e.models.join(",")}]` : "";
-      const installed = e.cronInstalled ? pc10.green("\u25CF") : pc10.red("\u2717");
+      const installed = e.cronInstalled ? pc11.green("\u25CF") : pc11.red("\u2717");
       console.log(
-        `  ${installed} ${pc10.bold(e.id.padEnd(32))} every ${pc10.bold(e.every.padEnd(5))} ${pc10.dim(e.cronExpr.padEnd(13))}${modelsStr}`
+        `  ${installed} ${pc11.bold(e.id.padEnd(32))} every ${pc11.bold(e.every.padEnd(5))} ${pc11.dim(e.cronExpr.padEnd(13))}${modelsStr}`
       );
-      console.log(`      ${pc10.dim("cwd:")} ${e.cwd}`);
+      console.log(`      ${pc11.dim("cwd:")} ${e.cwd}`);
     }
     console.log(`
-${pc10.dim("\u25CF = cron line installed  \u2717 = registry drift, run `sync schedule repair <id>`")}`);
+${pc11.dim("\u25CF = cron line installed  \u2717 = registry drift, run `sync schedule repair <id>`")}`);
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
   }
@@ -8791,7 +9233,7 @@ async function syncScheduleRemoveCommand(idOrPlatform, options) {
       return;
     }
     for (const r of result.removed) {
-      console.log(`  ${pc10.green("\u2713")} removed ${pc10.bold(r.id)} ${pc10.dim(`(${r.cwd})`)}`);
+      console.log(`  ${pc11.green("\u2713")} removed ${pc11.bold(r.id)} ${pc11.dim(`(${r.cwd})`)}`);
     }
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -8809,21 +9251,21 @@ async function syncScheduleStatusCommand() {
       return;
     }
     for (const s of statuses) {
-      const driftMarker = s.drift === "ok" ? pc10.green("\u25CF") : s.drift === "missing-cron" ? pc10.red("\u2717 missing cron line") : pc10.yellow(`\u26A0 ${s.drift}`);
-      console.log(`  ${driftMarker} ${pc10.bold(s.entry.id)} \u2014 every ${s.entry.every} (${pc10.dim(s.entry.cronExpr)})`);
-      console.log(`      ${pc10.dim("cwd:")} ${s.entry.cwd}`);
-      console.log(`      ${pc10.dim("last run:")} ${s.lastRunAt ?? pc10.yellow("never")}`);
-      console.log(`      ${pc10.dim("log:")} ${s.entry.logFile} ${s.logExists ? pc10.dim(`(${s.logSize} bytes)`) : pc10.yellow("(empty)")}`);
+      const driftMarker = s.drift === "ok" ? pc11.green("\u25CF") : s.drift === "missing-cron" ? pc11.red("\u2717 missing cron line") : pc11.yellow(`\u26A0 ${s.drift}`);
+      console.log(`  ${driftMarker} ${pc11.bold(s.entry.id)} \u2014 every ${s.entry.every} (${pc11.dim(s.entry.cronExpr)})`);
+      console.log(`      ${pc11.dim("cwd:")} ${s.entry.cwd}`);
+      console.log(`      ${pc11.dim("last run:")} ${s.lastRunAt ?? pc11.yellow("never")}`);
+      console.log(`      ${pc11.dim("log:")} ${s.entry.logFile} ${s.logExists ? pc11.dim(`(${s.logSize} bytes)`) : pc11.yellow("(empty)")}`);
       if (s.logTail.length > 0) {
-        console.log(pc10.dim("      last lines:"));
+        console.log(pc11.dim("      last lines:"));
         for (const line of s.logTail.slice(-3)) {
-          console.log(pc10.dim(`        ${line}`));
+          console.log(pc11.dim(`        ${line}`));
         }
       }
     }
     if (statuses.some((s) => s.drift !== "ok")) {
       console.log(`
-${pc10.yellow("Drift detected.")} Run ${pc10.bold("one sync schedule repair <id>")} to heal.`);
+${pc11.yellow("Drift detected.")} Run ${pc11.bold("one sync schedule repair <id>")} to heal.`);
     }
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
@@ -8836,7 +9278,7 @@ async function syncScheduleRepairCommand(id) {
       json({ status: "repaired", ...healed });
       return;
     }
-    outro(`Repaired ${pc10.bold(healed.id)}: re-installed cron line with current node/cli paths.`);
+    outro(`Repaired ${pc11.bold(healed.id)}: re-installed cron line with current node/cli paths.`);
   } catch (err) {
     error(err instanceof Error ? err.message : String(err));
   }
@@ -8905,7 +9347,7 @@ function registerSyncSubcommands(sync) {
     await syncSqlCommand(platformModel, sql);
   });
   sync.command("schema <platform/model>").description("Inspect the JSON structure of synced records (field paths, types, examples) \u2014 useful before writing `sync sql` queries").action(async (platformModel) => {
-    const { syncSchemaCommand } = await import("./schema-4JJO2CIZ.js");
+    const { syncSchemaCommand } = await import("./schema-OO4WK5ND.js");
     await syncSchemaCommand(platformModel);
   });
   sync.command("delete <platform/model>").description('Delete records from local sync data (e.g. one sync delete notion/pages --id "abc-123")').option("--id <value>", "Delete record by ID").option("--where <conditions>", 'Delete records matching conditions (e.g. "status=archived")').option("--where-sql <predicate>", `Delete using a raw SQL WHERE clause (e.g. "json_extract(data, '$.type') = 'promotion'")`).option("--yes", "Skip confirmation prompt").action(async (platformModel, options) => {
@@ -9272,16 +9714,16 @@ function projectEmbeddingApiKey(cfg) {
 }
 function redactSecrets(cfg) {
   const copy = JSON.parse(JSON.stringify(cfg));
-  for (const path13 of SECRET_PATHS) {
-    const val = getPath(copy, path13);
+  for (const path14 of SECRET_PATHS) {
+    const val = getPath(copy, path14);
     if (typeof val === "string" && val.length > 0) {
-      setPath(copy, path13, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
+      setPath(copy, path14, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
     }
   }
   return copy;
 }
-function getPath(obj, path13) {
-  const parts = path13.split(".");
+function getPath(obj, path14) {
+  const parts = path14.split(".");
   let cur = obj;
   for (const part of parts) {
     if (cur == null || typeof cur !== "object") return void 0;
@@ -9289,8 +9731,8 @@ function getPath(obj, path13) {
   }
   return cur;
 }
-function setPath(obj, path13, value) {
-  const parts = path13.split(".");
+function setPath(obj, path14, value) {
+  const parts = path14.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
@@ -9300,8 +9742,8 @@ function setPath(obj, path13, value) {
   cur[parts[parts.length - 1]] = value;
   return obj;
 }
-function unsetPath(obj, path13) {
-  const parts = path13.split(".");
+function unsetPath(obj, path14) {
+  const parts = path14.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part = parts[i];
@@ -9327,7 +9769,7 @@ function parseValue(raw) {
 }
 
 // src/commands/mem/records.ts
-import pc11 from "picocolors";
+import pc12 from "picocolors";
 async function memAddCommand(type, dataRaw, flags) {
   requireMemoryInit();
   const data = parseJsonArg(dataRaw, "data");
@@ -9526,7 +9968,7 @@ function summarizeRecord(r) {
     const v = d[field];
     if (typeof v === "string" && v.trim()) return v.trim().slice(0, 80);
   }
-  return pc11.dim("(untitled)");
+  return pc12.dim("(untitled)");
 }
 function relativeTime(iso) {
   if (!iso) return "";
@@ -9589,7 +10031,7 @@ async function memFindByKeyCommand(key, secondKey, flags) {
     });
     return;
   }
-  const label = matchedKeys.map((k) => pc11.cyan(k)).join(pc11.dim(" + "));
+  const label = matchedKeys.map((k) => pc12.cyan(k)).join(pc12.dim(" + "));
   if (records.length === 0) {
     console.log(`
   No records linked to ${label}.
@@ -9597,27 +10039,27 @@ async function memFindByKeyCommand(key, secondKey, flags) {
     return;
   }
   console.log();
-  console.log(`  ${label} ${pc11.dim("\u2014")} ${records.length}${truncated ? "+" : ""} record${records.length === 1 ? "" : "s"} across ${byType.size} type${byType.size === 1 ? "" : "s"}`);
+  console.log(`  ${label} ${pc12.dim("\u2014")} ${records.length}${truncated ? "+" : ""} record${records.length === 1 ? "" : "s"} across ${byType.size} type${byType.size === 1 ? "" : "s"}`);
   console.log();
   const typeWidth = Math.min(30, Math.max(...[...byType.keys()].map((t) => t.length)));
   for (const [type, list] of byType) {
-    console.log(`  ${pc11.bold(type.padEnd(typeWidth))}  ${pc11.dim(`${list.length} record${list.length === 1 ? "" : "s"}`)}`);
+    console.log(`  ${pc12.bold(type.padEnd(typeWidth))}  ${pc12.dim(`${list.length} record${list.length === 1 ? "" : "s"}`)}`);
     for (const r of list.slice(0, perType)) {
-      console.log(`    ${pc11.dim("\xB7")} ${summarizeRecord(r)}  ${pc11.dim(relativeTime(r.updated_at))}  ${pc11.dim(r.id)}`);
+      console.log(`    ${pc12.dim("\xB7")} ${summarizeRecord(r)}  ${pc12.dim(relativeTime(r.updated_at))}  ${pc12.dim(r.id)}`);
     }
     if (list.length > perType) {
-      console.log(`    ${pc11.dim(`\u2026 and ${list.length - perType} more (raise --limit)`)}`);
+      console.log(`    ${pc12.dim(`\u2026 and ${list.length - perType} more (raise --limit)`)}`);
     }
   }
   if (truncated) {
     console.log();
-    console.log(`  ${pc11.yellow("\u26A0")} Stopped at ${FIND_BY_KEY_FETCH_CAP} matches \u2014 there are more, and types sorting after the last one shown are missing entirely. Re-run with --type <type> to see them.`);
+    console.log(`  ${pc12.yellow("\u26A0")} Stopped at ${FIND_BY_KEY_FETCH_CAP} matches \u2014 there are more, and types sorting after the last one shown are missing entirely. Re-run with --type <type> to see them.`);
   }
   console.log();
 }
 
 // src/commands/mem/doctor.ts
-import pc12 from "picocolors";
+import pc13 from "picocolors";
 async function memDoctorCommand() {
   const checks = [];
   const cfg = getMemoryConfig();
@@ -9682,7 +10124,7 @@ async function memDoctorCommand() {
   }
   if (cfg.embedding.provider === "openai") {
     try {
-      const { embed: embed2 } = await import("./embedding-Z2WCDN6R.js");
+      const { embed: embed2 } = await import("./embedding-OXX4OF65.js");
       const result = await embed2("connectivity check");
       checks.push({
         name: "OpenAI embedding provider reachable",
@@ -9724,23 +10166,23 @@ function emit(checks, capInfo) {
     return;
   }
   for (const c of checks) {
-    const mark = c.ok ? pc12.green("\u2713") : pc12.red("\u2717");
-    const detail = c.detail ? pc12.dim(` \u2014 ${c.detail}`) : "";
+    const mark = c.ok ? pc13.green("\u2713") : pc13.red("\u2717");
+    const detail = c.detail ? pc13.dim(` \u2014 ${c.detail}`) : "";
     console.log(`  ${mark} ${c.name}${detail}`);
   }
   if (!allOk) {
-    console.log("\n" + pc12.yellow("Memory is not fully healthy."));
+    console.log("\n" + pc13.yellow("Memory is not fully healthy."));
     process.exitCode = 1;
   } else {
-    console.log("\n" + pc12.green("Memory is healthy."));
+    console.log("\n" + pc13.green("Memory is healthy."));
   }
   const line = semanticSearchUpgradeLine({ vectorSearchAvailable: capInfo.vectorSearchAvailable });
   if (line) console.log(`
-${pc12.dim(line)}`);
+${pc13.dim(line)}`);
 }
 
 // src/commands/mem/export.ts
-import fs11 from "fs";
+import fs12 from "fs";
 import { once } from "events";
 async function writeLine(stream, line) {
   if (!stream.write(line)) {
@@ -9752,7 +10194,7 @@ async function memExportCommand(outfile) {
   const backend = await getBackend();
   const stats = await backend.stats();
   const toFile = !!outfile && outfile !== "-";
-  const stream = toFile ? fs11.createWriteStream(outfile, "utf-8") : process.stdout;
+  const stream = toFile ? fs12.createWriteStream(outfile, "utf-8") : process.stdout;
   const all = await listAllTypes(backend);
   const pageSize = 500;
   let written = 0;
@@ -9783,9 +10225,9 @@ async function memExportCommand(outfile) {
 }
 async function memImportCommand(file) {
   requireMemoryInit();
-  if (!fs11.existsSync(file)) error(`File not found: ${file}`);
+  if (!fs12.existsSync(file)) error(`File not found: ${file}`);
   const backend = await getBackend();
-  const raw = fs11.readFileSync(file, "utf-8");
+  const raw = fs12.readFileSync(file, "utf-8");
   const lines = raw.split("\n").filter((l) => l.trim().length > 0);
   let inserted = 0;
   let updated = 0;
@@ -10031,7 +10473,7 @@ function registerMemoryCommands(program2) {
 }
 
 // src/commands/cache.ts
-import pc13 from "picocolors";
+import pc14 from "picocolors";
 async function cacheClearCommand(actionId) {
   if (actionId) {
     const deleted = clearEntry(actionId);
@@ -10040,9 +10482,9 @@ async function cacheClearCommand(actionId) {
       return;
     }
     if (deleted) {
-      console.log(`Cleared cache for ${pc13.cyan(actionId)}`);
+      console.log(`Cleared cache for ${pc14.cyan(actionId)}`);
     } else {
-      console.log(`No cache entry found for ${pc13.dim(actionId)}`);
+      console.log(`No cache entry found for ${pc14.dim(actionId)}`);
     }
   } else {
     const count = clearAll();
@@ -10079,7 +10521,7 @@ async function cacheListCommand(options) {
     type: e.type,
     key: e.entry.key,
     age: formatAge(getAge(e.entry)),
-    status: isFresh(e.entry) ? pc13.green("fresh") : pc13.yellow("expired")
+    status: isFresh(e.entry) ? pc14.green("fresh") : pc14.yellow("expired")
   }));
   printTable(
     [
@@ -10109,8 +10551,8 @@ async function cacheUpdateAllCommand() {
     console.log("No cached entries to update");
     return;
   }
-  const spinner5 = createSpinner();
-  spinner5.start(`Updating ${entries.length} cached ${entries.length === 1 ? "entry" : "entries"}...`);
+  const spinner4 = createSpinner();
+  spinner4.start(`Updating ${entries.length} cached ${entries.length === 1 ? "entry" : "entries"}...`);
   let updated = 0;
   let failed = 0;
   const errors = [];
@@ -10162,7 +10604,7 @@ async function cacheUpdateAllCommand() {
       });
     }
   }
-  spinner5.stop(`Updated ${updated} ${updated === 1 ? "entry" : "entries"}${failed > 0 ? `, ${failed} failed` : ""}`);
+  spinner4.stop(`Updated ${updated} ${updated === 1 ? "entry" : "entries"}${failed > 0 ? `, ${failed} failed` : ""}`);
   if (isAgentMode()) {
     json({ updated, failed, errors: errors.length > 0 ? errors : void 0 });
     return;
@@ -10170,13 +10612,13 @@ async function cacheUpdateAllCommand() {
   if (errors.length > 0) {
     console.log();
     for (const e of errors) {
-      console.log(`  ${pc13.red("\u2717")} ${e.key}: ${pc13.dim(e.error)}`);
+      console.log(`  ${pc14.red("\u2717")} ${e.key}: ${pc14.dim(e.error)}`);
     }
   }
 }
 
 // src/commands/guide.ts
-import pc14 from "picocolors";
+import pc15 from "picocolors";
 
 // src/lib/guide-content.ts
 var GUIDE_OVERVIEW = `# One CLI \u2014 Agent Guide
@@ -10189,6 +10631,8 @@ var GUIDE_OVERVIEW = `# One CLI \u2014 Agent Guide
 
 You can also use \`one login\` / \`one logout\` to manage authentication separately (global or per-directory).
 
+Browser login opens a consent page that names the key and tags it with where the CLI runs (scope, project path, machine, OS user, CLI version, the agent harnesses you pick, and the per-install device id unless telemetry is off), so the dashboard can show every install. The terminal prints what will be sent before the browser opens. Set \`ONE_APP_URL\` (dashboard origin) and \`ONE_API_BASE\` (API origin) to run against a local stack; neither is written to config, so pair them with \`ONE_HOME\` to keep a local stack's credentials separate.
+
 ### Agent-driven setup (no prompts)
 To onboard a user without any terminal interaction, pass \`--auth\` to \`one init\`. This disables every prompt, auto-installs the One skill, and skips the connect-a-platform step (run \`one add <platform>\` afterwards).
 
@@ -11337,14 +11781,14 @@ async function guideCommand(topic = "all") {
     json({ topic, title, content, availableTopics });
     return;
   }
-  intro(pc14.bgCyan(pc14.black(" One Guide ")));
+  intro(pc15.bgCyan(pc15.black(" One Guide ")));
   console.log();
   console.log(content);
-  console.log(pc14.dim("\u2500".repeat(60)));
+  console.log(pc15.dim("\u2500".repeat(60)));
   console.log(
-    pc14.dim("Available topics: ") + availableTopics.map((t) => pc14.cyan(t.topic)).join(", ")
+    pc15.dim("Available topics: ") + availableTopics.map((t) => pc15.cyan(t.topic)).join(", ")
   );
-  console.log(pc14.dim(`Run ${pc14.cyan("one guide <topic>")} for a specific section.`));
+  console.log(pc15.dim(`Run ${pc15.cyan("one guide <topic>")} for a specific section.`));
 }
 
 // src/lib/platform-meta.ts
@@ -11665,7 +12109,7 @@ function buildWorkflowIdeas(connections) {
 }
 
 // src/commands/logout.ts
-import fs12 from "fs";
+import fs13 from "fs";
 import * as p9 from "@clack/prompts";
 function formatWhoami(config2, apiKey, pc16) {
   const whoami = config2.whoami;
@@ -11679,8 +12123,10 @@ function formatWhoami(config2, apiKey, pc16) {
     const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
     lines.push(`${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`);
     lines.push(`${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`);
+    if (config2.apiKeyName) lines.push(`${pc16.dim("Key:")} ${config2.apiKeyName}`);
   } else {
-    lines.push(`${pc16.dim("Key:")} ${apiKey.slice(0, 8)}... ${pc16.dim("\xB7")} ${envLabel}`);
+    const keyLabel = config2.apiKeyName ?? `${apiKey.slice(0, 8)}...`;
+    lines.push(`${pc16.dim("Key:")} ${keyLabel} ${pc16.dim("\xB7")} ${envLabel}`);
   }
   return lines;
 }
@@ -11698,12 +12144,12 @@ async function logoutCommand() {
     const globalPath = getGlobalConfigPath();
     const projectPath = getProjectConfigPath();
     let cleared = false;
-    if (fs12.existsSync(projectPath)) {
-      fs12.unlinkSync(projectPath);
+    if (fs13.existsSync(projectPath)) {
+      fs13.unlinkSync(projectPath);
       cleared = true;
     }
-    if (fs12.existsSync(globalPath)) {
-      fs12.unlinkSync(globalPath);
+    if (fs13.existsSync(globalPath)) {
+      fs13.unlinkSync(globalPath);
       cleared = true;
     }
     json({ status: cleared ? "logged_out" : "not_logged_in", message: cleared ? "Credentials cleared." : "No config found." });
@@ -11772,328 +12218,17 @@ async function logoutCommand() {
   }
   if (targetScope === "project" || targetScope === "both") {
     const projectPath = getProjectConfigPath();
-    if (fs12.existsSync(projectPath)) fs12.unlinkSync(projectPath);
+    if (fs13.existsSync(projectPath)) fs13.unlinkSync(projectPath);
   }
   if (targetScope === "global" || targetScope === "both") {
     const globalPath = getGlobalConfigPath();
-    if (fs12.existsSync(globalPath)) fs12.unlinkSync(globalPath);
+    if (fs13.existsSync(globalPath)) fs13.unlinkSync(globalPath);
   }
   p9.log.success("Credentials cleared.");
   p9.log.info("Your API key is still active. Manage keys at app.withone.ai/settings");
   p9.outro("Logged out.");
 }
 
-// src/lib/analytics.ts
-import { createRequire as createRequire2 } from "module";
-import { randomUUID, createHash } from "crypto";
-import pc15 from "picocolors";
-var require3 = createRequire2(import.meta.url);
-var DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
-var DEFAULT_POSTHOG_KEY = "phc_a9ok4w0uxiZcVoSWOISIlin85lHMXQD3vWPaYnuRlRV";
-var SEND_MAX_ATTEMPTS = 3;
-var QUEUE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
-var EXIT_GRACE_MS = 300;
-var inFlight = /* @__PURE__ */ new Set();
-var pending = /* @__PURE__ */ new Set();
-var dispatched = /* @__PURE__ */ new Set();
-var delivered = /* @__PURE__ */ new Set();
-var UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-function uuidFromInsertId(insertId) {
-  if (UUID_SHAPE.test(insertId)) return insertId.toLowerCase();
-  const h = createHash("sha1").update(`one-cli-event:${insertId}`).digest("hex");
-  const variant = (parseInt(h[16], 16) & 3 | 8).toString(16);
-  return `${h.slice(0, 8)}-${h.slice(8, 12)}-5${h.slice(13, 16)}-${variant}${h.slice(17, 20)}-${h.slice(20, 32)}`;
-}
-function posthogHost() {
-  return process.env.ONE_POSTHOG_HOST || DEFAULT_POSTHOG_HOST;
-}
-function posthogKey() {
-  return process.env.ONE_POSTHOG_KEY || DEFAULT_POSTHOG_KEY;
-}
-function envName() {
-  const key = getApiKey();
-  return key ? getEnvFromApiKey(key) : "live";
-}
-function isOn(value) {
-  return value === "1" || value === "true";
-}
-function debugLog(message) {
-  if (isOn(process.env.ONE_ANALYTICS_DEBUG)) {
-    process.stderr.write(`[analytics] ${message}
-`);
-  }
-}
-function isTelemetryDisabled() {
-  if (isOn(process.env.ONE_NO_TELEMETRY) || isOn(process.env.ONE_DISABLE_TELEMETRY)) return true;
-  if (isOn(process.env.DO_NOT_TRACK)) return true;
-  if (isOn(process.env.CI)) return true;
-  if (readConfig()?.telemetry === "off") return true;
-  return false;
-}
-function distinctId() {
-  return getWhoAmI()?.user?.id ?? getDeviceId();
-}
-function isAuthenticated() {
-  return !!getWhoAmI()?.user || !!getApiKey();
-}
-function baseProperties() {
-  return {
-    $lib: "one-cli",
-    cli_version: cliVersion(),
-    agent_mode: isAgentMode(),
-    env: envName(),
-    os: process.platform,
-    arch: process.arch,
-    node_version: process.versions.node,
-    authenticated: isAuthenticated()
-  };
-}
-function personSet() {
-  const whoami = getWhoAmI();
-  if (!whoami?.user) return void 0;
-  const set = {};
-  if (whoami.user.email) set.email = whoami.user.email;
-  if (whoami.user.name) set.name = whoami.user.name;
-  if (whoami.organization?.id) set.organization_id = whoami.organization.id;
-  return Object.keys(set).length ? set : void 0;
-}
-function send(item) {
-  const insertId = item.properties.$insert_id;
-  if (insertId) dispatched.add(insertId);
-  const controller = new AbortController();
-  inFlight.add(controller);
-  const run = (async () => {
-    try {
-      const res = await fetch(`${posthogHost()}/i/v0/e/`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          api_key: posthogKey(),
-          event: item.event,
-          distinct_id: item.distinct_id,
-          // PostHog's dedupe key — a re-sent copy is dropped on ingest.
-          uuid: item.uuid ?? (insertId ? uuidFromInsertId(insertId) : void 0),
-          properties: item.properties,
-          timestamp: item.timestamp
-        }),
-        signal: controller.signal
-      });
-      if (res.ok && insertId) delivered.add(insertId);
-      debugLog(`"${item.event}" -> HTTP ${res.status}${res.ok ? "" : " (retry next run)"}`);
-    } catch (err) {
-      debugLog(`"${item.event}" not sent: ${err instanceof Error ? err.message : String(err)} (retry next run)`);
-    } finally {
-      inFlight.delete(controller);
-    }
-  })();
-  pending.add(run);
-  void run.finally(() => pending.delete(run));
-}
-function capture(event, properties = {}, opts = {}) {
-  if (isTelemetryDisabled()) {
-    debugLog(`disabled \u2014 skipping "${event}"`);
-    return;
-  }
-  const did = opts.distinctId ?? distinctId();
-  const props = { ...baseProperties(), ...properties };
-  if (props.$insert_id === void 0) props.$insert_id = randomUUID();
-  const insertId = props.$insert_id;
-  if (opts.personProfile === false) {
-    props.$process_person_profile = false;
-  } else if (did === distinctId()) {
-    const set = personSet();
-    if (set) props.$set = set;
-  }
-  const item = {
-    event,
-    distinct_id: did,
-    properties: props,
-    timestamp: opts.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
-    uuid: uuidFromInsertId(insertId)
-  };
-  appendAnalyticsQueue(JSON.stringify(item));
-}
-var ROLLUP_WINDOW_MS = 5 * 60 * 1e3;
-var ROLLUP_MAX_BATCH = 500;
-function utcDay(ts) {
-  return new Date(ts).toISOString().slice(0, 10);
-}
-var PRE_AUTH_COMMANDS = /* @__PURE__ */ new Set([
-  "init",
-  "login",
-  "logout",
-  "guide",
-  "platforms",
-  "onboard",
-  "config",
-  "update",
-  "help"
-]);
-function shouldRecord(commandPath2) {
-  if (isAuthenticated()) return true;
-  return PRE_AUTH_COMMANDS.has(commandPath2.split(" ")[0]);
-}
-function recordCommand(command) {
-  if (isTelemetryDisabled()) {
-    writeUsageLog([]);
-    return;
-  }
-  const cmdPath = commandPath(command);
-  if (!shouldRecord(cmdPath)) return;
-  const did = distinctId();
-  const entry = { ts: Date.now(), command: cmdPath, agent: isAgentMode(), did };
-  appendUsageLog(JSON.stringify(entry));
-  const today = utcDay(entry.ts);
-  const state = readUsageState();
-  const firstTouch = state.lastDay !== today || state.distinctId !== did;
-  flushUsageRollups({ force: firstTouch });
-  if (firstTouch) writeUsageState({ lastDay: today, distinctId: did });
-}
-function flushUsageRollups(opts = {}) {
-  if (isTelemetryDisabled()) {
-    writeUsageLog([]);
-    return;
-  }
-  const lines = claimUsageLog();
-  if (!lines || lines.length === 0) return;
-  const entries = [];
-  for (const line of lines) {
-    try {
-      const e = JSON.parse(line);
-      if (e && typeof e.ts === "number" && typeof e.command === "string" && typeof e.did === "string") {
-        entries.push(e);
-      }
-    } catch {
-    }
-  }
-  if (entries.length === 0) return;
-  const currentDid = entries[entries.length - 1].did;
-  const now = Date.now();
-  const groups = /* @__PURE__ */ new Map();
-  for (const e of entries) {
-    const g = groups.get(e.did);
-    if (g) g.push(e);
-    else groups.set(e.did, [e]);
-  }
-  const kept = [];
-  for (const [did, group] of groups) {
-    const due = opts.force === true || did !== currentDid || // a superseded login's batch — flush it now
-    group.length >= ROLLUP_MAX_BATCH || now - group[0].ts >= ROLLUP_WINDOW_MS;
-    if (due) emitRollup(did, group);
-    else kept.push(...group);
-  }
-  for (const e of kept) appendUsageLog(JSON.stringify(e));
-}
-function emitRollup(did, group) {
-  const byCommand = {};
-  let agentCount = 0;
-  for (const e of group) {
-    byCommand[e.command] = (byCommand[e.command] ?? 0) + 1;
-    if (e.agent) agentCount += 1;
-  }
-  const insertId = createHash("sha1").update(`${did}|${group.map((e) => `${e.ts}:${e.command}:${e.agent ? 1 : 0}`).join("|")}`).digest("hex");
-  capture(
-    "CLI Usage Rollup",
-    {
-      command_count: group.length,
-      by_command: byCommand,
-      agent_count: agentCount,
-      human_count: group.length - agentCount,
-      window_start: new Date(group[0].ts).toISOString(),
-      window_end: new Date(group[group.length - 1].ts).toISOString(),
-      $insert_id: insertId
-    },
-    {
-      distinctId: did,
-      timestamp: new Date(group[group.length - 1].ts).toISOString(),
-      // Rollups bill at the anonymous rate; the person already exists.
-      personProfile: false
-    }
-  );
-  debugLog(`rollup \u2014 ${group.length} command(s) for ${did}`);
-}
-function commandPath(command) {
-  const parts = [];
-  let current = command;
-  while (current && current.name() && current.name() !== "one") {
-    parts.unshift(current.name());
-    current = current.parent;
-  }
-  return parts.join(" ") || command.name();
-}
-function drainQueue() {
-  if (isTelemetryDisabled()) {
-    writeAnalyticsQueue([]);
-    return;
-  }
-  const now = Date.now();
-  const kept = [];
-  let changed = false;
-  for (const line of readAnalyticsQueue()) {
-    let item;
-    try {
-      item = JSON.parse(line);
-    } catch {
-      changed = true;
-      continue;
-    }
-    const insertId = item?.properties?.$insert_id;
-    if (!insertId) {
-      changed = true;
-      continue;
-    }
-    const age = now - Date.parse(item.timestamp);
-    const attempts = item.attempts ?? 0;
-    if (!(age < QUEUE_MAX_AGE_MS) || attempts >= SEND_MAX_ATTEMPTS) {
-      debugLog(`"${item.event}" dropped (${attempts} attempts, ${Math.round(age / 6e4)} min old)`);
-      changed = true;
-      continue;
-    }
-    if (dispatched.has(insertId)) {
-      kept.push(line);
-      continue;
-    }
-    item.attempts = attempts + 1;
-    if (!item.uuid) item.uuid = uuidFromInsertId(insertId);
-    kept.push(JSON.stringify(item));
-    changed = true;
-    send(item);
-  }
-  if (changed) writeAnalyticsQueue(kept);
-}
-async function flush() {
-  if (pending.size > 0) {
-    await Promise.race([
-      Promise.allSettled([...pending]),
-      new Promise((resolve) => setTimeout(resolve, EXIT_GRACE_MS))
-    ]);
-  }
-  for (const controller of inFlight) controller.abort();
-  const remaining = readAnalyticsQueue().filter((line) => {
-    try {
-      const item = JSON.parse(line);
-      const id = item.properties?.$insert_id;
-      if (!id || delivered.has(id)) return false;
-      return (item.attempts ?? 0) < SEND_MAX_ATTEMPTS;
-    } catch {
-      return false;
-    }
-  });
-  writeAnalyticsQueue(remaining);
-  dispatched.clear();
-  delivered.clear();
-}
-function maybeShowTelemetryNotice() {
-  if (isTelemetryDisabled() || isAgentMode()) return;
-  if (telemetryNoticeShown()) return;
-  markTelemetryNoticeShown();
-  process.stderr.write(
-    pc15.dim(
-      "One CLI collects usage analytics (which commands run, linked to your One account) to improve the product.\nNo arguments, inputs, or secrets are ever collected. Opt out anytime with ONE_NO_TELEMETRY=1.\n"
-    )
-  );
-}
-
 // src/cli.ts
 silenceWarningsInAgentMode();
 var require4 = createRequire3(import.meta.url);
@@ -12102,7 +12237,7 @@ var program = new Command();
 program.name("one").option("--agent", "Machine-readable JSON output (no colors, spinners, or prompts)").description(`One CLI \u2014 Connect AI agents to 600+ platforms through one interface.
 
   Setup:
-    one login                             Authenticate via browser (opens app.withone.ai)
+    one login                             Authenticate via browser; the consent page records where this CLI is installed
     one logout                            Clear local credentials
     one init                              Set up API key + skill (add --auth browser for no-prompt agent setup)
     one add <platform>                    Connect a platform via OAuth (e.g. gmail, slack, shopify)
@@ -12312,8 +12447,8 @@ config.command("reset").description("Remove the project config for the current d
         return;
       }
     }
-    const fs14 = await import("fs");
-    fs14.unlinkSync(globalPath);
+    const fs15 = await import("fs");
+    fs15.unlinkSync(globalPath);
     if (isAgentMode()) {
       json({ deleted: true, scope: "global" });
     } else {
@@ -12330,15 +12465,15 @@ config.command("reset").description("Remove the project config for the current d
     }
     return;
   }
-  const fs13 = await import("fs");
-  const configContent = fs13.readFileSync(resolved.path, "utf-8");
-  fs13.unlinkSync(resolved.path);
+  const fs14 = await import("fs");
+  const configContent = fs14.readFileSync(resolved.path, "utf-8");
+  fs14.unlinkSync(resolved.path);
   const next = resolveConfig();
-  fs13.mkdirSync(path12.dirname(resolved.path), { recursive: true });
-  fs13.writeFileSync(resolved.path, configContent);
+  fs14.mkdirSync(path13.dirname(resolved.path), { recursive: true });
+  fs14.writeFileSync(resolved.path, configContent);
   let fallbackLabel;
   if (next.scope === "project") {
-    fallbackLabel = `parent project config (${path12.basename(next.projectRoot)})`;
+    fallbackLabel = `parent project config (${path13.basename(next.projectRoot)})`;
   } else if (next.scope === "global") {
     fallbackLabel = "global config";
   } else {
@@ -12347,7 +12482,7 @@ config.command("reset").description("Remove the project config for the current d
   if (!isAgentMode()) {
     const p10 = await import("@clack/prompts");
     const confirmed = await p10.confirm({
-      message: `Delete project config for ${path12.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
+      message: `Delete project config for ${path13.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
       initialValue: false
     });
     if (p10.isCancel(confirmed) || !confirmed) {
@@ -12355,9 +12490,9 @@ config.command("reset").description("Remove the project config for the current d
       return;
     }
   }
-  fs13.unlinkSync(resolved.path);
+  fs14.unlinkSync(resolved.path);
   try {
-    fs13.rmdirSync(path12.dirname(resolved.path));
+    fs14.rmdirSync(path13.dirname(resolved.path));
   } catch {
   }
   if (isAgentMode()) {
@@ -12507,6 +12642,7 @@ program.command("whoami").description("Show the user, organization, and project
   const resolved = resolveConfig();
   const configScope = resolved.scope ?? "global";
   const apiBase = getApiBase();
+  const keyName = resolved.config?.apiKey === apiKey ? resolved.config.apiKeyName : void 0;
   if (isAgentMode()) {
     json({
       user: whoami.user,
@@ -12514,7 +12650,8 @@ program.command("whoami").description("Show the user, organization, and project
       project: whoami.project,
       env,
       configScope,
-      apiBase
+      apiBase,
+      keyName
     });
     return;
   }
@@ -12528,6 +12665,7 @@ program.command("whoami").description("Show the user, organization, and project
   console.log();
   console.log(`  ${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`);
   console.log(`  ${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`);
+  if (keyName) console.log(`  ${pc16.dim("Key:")} ${keyName}`);
   if (whoami.organization) console.log(`  ${pc16.dim("Org:")} ${whoami.organization.name} ${pc16.dim(`(${whoami.organization.id})`)}`);
   if (whoami.project) console.log(`  ${pc16.dim("Project:")} ${whoami.project.name} ${pc16.dim(`(${whoami.project.id})`)}`);
   console.log();