@withone/cli 1.57.1 → 2.1.0

package/dist/index.js

@@ -5,11 +5,8 @@ import {
   OneApi,
   PERMISSION_METHODS,
   TimeoutError,
-  buildActionKnowledgeWithGuidance,
-  buildCacheMeta,
   clearAll,
   clearEntry,
-  filterByPermissions,
   flowRequiresBash,
   formatAge,
   generateFlowGuide,
@@ -28,11 +25,10 @@ import {
   resolveActionDetails,
   resolveFlowPath,
   saveFlow,
-  searchCachePath,
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-QCXFSOTS.js";
+} from "./chunk-6EQDEYVD.js";
 import {
   memSqlCommand
 } from "./chunk-GKAIRI4Y.js";
@@ -165,11 +161,11 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 import fs from "fs";
 import path from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-function expandPath(p10) {
-  if (p10.startsWith("~/")) {
-    return path.join(homeDir(), p10.slice(2));
+function expandPath(p9) {
+  if (p9.startsWith("~/")) {
+    return path.join(homeDir(), p9.slice(2));
   }
-  return p10;
+  return p9;
 }
 function getClaudeDesktopConfigPath() {
   switch (process.platform) {
@@ -2615,16 +2611,16 @@ function formatAccess(access, maxActions = 2) {
 function findPlatform(platforms, query) {
   const normalizedQuery = query.toLowerCase().trim();
   const exact = platforms.find(
-    (p10) => p10.platform.toLowerCase() === normalizedQuery || p10.name.toLowerCase() === normalizedQuery
+    (p9) => p9.platform.toLowerCase() === normalizedQuery || p9.name.toLowerCase() === normalizedQuery
   );
   if (exact) return exact;
   return null;
 }
 function findSimilarPlatforms(platforms, query, limit = 3) {
   const normalizedQuery = query.toLowerCase().trim();
-  const scored = platforms.map((p10) => {
-    const name = p10.name.toLowerCase();
-    const slug = p10.platform.toLowerCase();
+  const scored = platforms.map((p9) => {
+    const name = p9.name.toLowerCase();
+    const slug = p9.platform.toLowerCase();
     let score = 0;
     if (name.includes(normalizedQuery) || slug.includes(normalizedQuery)) {
       score = 10;
@@ -2633,7 +2629,7 @@ function findSimilarPlatforms(platforms, query, limit = 3) {
     } else {
       score = countMatchingChars(normalizedQuery, slug);
     }
-    return { platform: p10, score };
+    return { platform: p9, score };
   }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score).slice(0, limit);
   return scored.map((item) => item.platform);
 }
@@ -2991,7 +2987,7 @@ function accessHint(permissions, actionIds, knowledgeOnly) {
   const parts = [];
   if (!actionIds.includes("*")) {
     parts.push(
-      "Action-scoped: each connection's `access.actions` are the only actions you may run \u2014 use them directly, no `actions search` needed."
+      "Action-scoped: each connection's `access.actions` are the only actions you may run \u2014 use them directly: `actions load <actionId>` reads their docs, no find needed."
     );
   } else if (permissions !== "admin") {
     const methods = PERMISSION_METHODS[permissions]?.join(", ") ?? "";
@@ -3107,7 +3103,6 @@ async function platformsCommand(options) {
 }
 
 // src/commands/actions.ts
-import * as p6 from "@clack/prompts";
 import pc8 from "picocolors";
 
 // src/lib/knowledge-sections.ts
@@ -3235,7 +3230,7 @@ var ESSENTIAL_PREFIX = ["required "];
 function classifyHeading(heading) {
   const c = canonicalHeading(heading);
   if (ESSENTIAL_EXACT.has(c)) return "essential";
-  if (ESSENTIAL_PREFIX.some((p10) => c.startsWith(p10))) return "essential";
+  if (ESSENTIAL_PREFIX.some((p9) => c.startsWith(p9))) return "essential";
   return "deferred";
 }
 function deferredPriority(heading) {
@@ -3248,14 +3243,14 @@ function deferredPriority(heading) {
   if (c === "response" || c.startsWith("success response") || c.startsWith("error response")) return 6;
   return 4;
 }
-function truncateText(text5, cap, id) {
+function truncateText(text5, cap, id, actionId) {
   const cut = text5.slice(0, cap);
   const nl = cut.lastIndexOf("\n");
   const head = nl > cap * 0.5 ? cut.slice(0, nl) : cut;
   const remaining = text5.length - head.length;
   return `${head}
 
-_[truncated \u2014 ${remaining.toLocaleString("en-US")} more chars. Load the full section with --section ${id}]_`;
+_[truncated \u2014 ${remaining.toLocaleString("en-US")} more chars. Load the full section with${actionId ? `: one --agent actions load ${actionId} --section ${id}` : ` --section ${id}`}]_`;
 }
 function buildDigest(doc, opts = {}) {
   const wholeThreshold = opts.wholeDocThreshold ?? DEFAULT_WHOLE_DOC_THRESHOLD;
@@ -3279,7 +3274,7 @@ function buildDigest(doc, opts = {}) {
       if (node.tier === "essential" || node.level >= 3 && hasEssentialDescendant(node)) {
         const own = node.text;
         if (own.length > cap) {
-          const render = truncateText(own, cap, node.id);
+          const render = truncateText(own, cap, node.id, opts.actionId);
           decisions.set(node.id, { node, included: "partial", render });
           used += render.length;
         } else {
@@ -3333,15 +3328,15 @@ function summary(s, included) {
   return { id: s.id, heading: s.heading, level: s.level, chars: s.chars, included };
 }
 function parentOf(roots, target) {
-  const find = (list, parent) => {
+  const find2 = (list, parent) => {
     for (const n of list) {
       if (n === target) return parent;
-      const r = find(n.children, n);
+      const r = find2(n.children, n);
       if (r !== void 0) return r;
     }
     return void 0;
   };
-  return find(roots, null) ?? null;
+  return find2(roots, null) ?? null;
 }
 function renderWhole(doc) {
   const out = [];
@@ -3373,10 +3368,7 @@ function collapseSections(sections, max = DEFAULT_TOC_MAX_ENTRIES) {
   }
   return { sections, collapsed: false };
 }
-function omittedSections(digest, max = DEFAULT_TOC_MAX_ENTRIES) {
-  return collapseSections(digest.sections.filter((s) => s.included !== true), max);
-}
-function renderDigestNotice(digest, platform, actionId) {
+function renderDigestNotice(digest, actionId) {
   if (!digest.truncated) return "";
   const topMost = digest.sections.filter((s, idx) => {
     if (s.included === true) return false;
@@ -3391,7 +3383,7 @@ function renderDigestNotice(digest, platform, actionId) {
     if (s.level === 1) return `${s.heading} (appendix)`;
     return s.heading;
   });
-  const base = `one --agent actions knowledge ${platform} ${actionId}`;
+  const base = `one --agent actions load ${actionId}`;
   const MAX_NAMES = 12;
   const shown = names.slice(0, MAX_NAMES);
   const rest = names.length - shown.length;
@@ -3493,6 +3485,394 @@ function parseSectionFlag(value) {
   return raw.flatMap((v) => v.split(",")).map((v) => v.trim()).filter(Boolean);
 }
 
+// src/lib/find.ts
+var FIND_MAX_INTENTS = 10;
+var FIND_MAX_LOADS = 10;
+var FIND_DOCUMENTS_BUDGET = 4e5;
+var NO_KNOWLEDGE = "(No additional knowledge available for this action.)";
+var REFUSED_LOAD = "no such action, or this CLI may not use it";
+var EXECUTE_GUIDE = `Run an action with:
+  one --agent actions execute <platform> <actionId> <connectionKey> [--path-vars '{...}'] [--query-params '{...}'] [-d '{...}']
+Connection keys come from \`one --agent list\`. Put each value where the action's documentation says it goes: path variables (placeholders like {userId}) in --path-vars, query parameters in --query-params, the request body in -d. Never put path variables or query parameters in -d.`;
+var FindArgsError = class extends Error {
+};
+function actionHeading(action) {
+  return `${action.title} \xB7 \`${action.method.toUpperCase()} ${action.path}\` \xB7 actionId: \`${action.actionId}\``;
+}
+var ref = (a) => ({ actionId: a.systemId, title: a.title, method: a.method, path: a.path });
+function allows(settings, action) {
+  return isActionAllowed(action.systemId, settings.actionIds) && isMethodAllowed(action.method, settings.permissions);
+}
+async function reachable(settings, deps) {
+  if (settings.connectionKeys.includes("*")) return null;
+  return (await deps.connectedPlatforms()).map((p9) => p9.toLowerCase());
+}
+function narrow(answer, settings) {
+  const allowed = (action) => allows(settings, action);
+  const selected = answer.selected.filter(allowed);
+  const alternatives = answer.alternatives.filter(allowed);
+  let alsoSelected = (answer.alsoSelected ?? []).filter(allowed);
+  let runnerUp = answer.runnerUp && allowed(answer.runnerUp) ? answer.runnerUp : void 0;
+  let replaced = false;
+  let pickRefused = false;
+  if (answer.selected.length > 0 && !allowed(answer.selected[0])) {
+    const next = runnerUp ?? alternatives.shift();
+    if (next) {
+      selected.unshift(next);
+      runnerUp = next === runnerUp ? void 0 : runnerUp;
+      replaced = true;
+    } else {
+      alsoSelected = [...selected, ...alsoSelected];
+      selected.length = 0;
+      pickRefused = true;
+    }
+  }
+  const found = answer.selected.length + answer.alternatives.length + (answer.alsoSelected?.length ?? 0) + (answer.runnerUp ? 1 : 0);
+  const kept = selected.length + alternatives.length + alsoSelected.length + (runnerUp ? 1 : 0);
+  return {
+    answer: { ...answer, selected, alsoSelected, runnerUp, alternatives },
+    replaced,
+    pickRefused: pickRefused && kept > 0,
+    refusedAll: found > 0 && kept === 0
+  };
+}
+function status(answer, narrowed) {
+  if (narrowed.pickRefused) {
+    return "The chosen action is not allowed by this CLI, and no allowed candidate can take its place. The actions listed were needed beside it; tell the user which operation is blocked.";
+  }
+  if (narrowed.refusedAll) {
+    return "Actions were found for this intent, but this CLI's access settings (action allowlist, permission level) allow none of them, so rephrasing will not help. Tell the user which operation is blocked.";
+  }
+  if (narrowed.replaced) {
+    return "The chosen action is not allowed by this CLI, so this is the next allowed candidate: check it fits before using it.";
+  }
+  if (answer.selector === "none_fit" || answer.selected.length === 0) {
+    return answer.alternatives.length === 0 ? "No action fits this intent, and nothing close was found. Rephrase it, or check the platform name." : "No action fits this intent. Rephrase it more specifically, or load one of the alternatives.";
+  }
+  if (answer.selector === "search_order") {
+    return "The decision model was unavailable, so this is the top search result: check it fits before using it.";
+  }
+  return answer.confidence === void 0 ? "Chosen by the decision model." : `Chosen with confidence ${answer.confidence.toFixed(2)}.`;
+}
+function document(action, details, platform, settings) {
+  if (details instanceof Error) {
+    return {
+      ...action,
+      knowledge: `Its documentation could not be loaded (${details.message}). Load it with \`one --agent actions load ${action.actionId}\` before executing it; never execute it without reading it.`,
+      truncated: true
+    };
+  }
+  const knowledge = details.knowledge;
+  if (settings.knowledgeAgent) {
+    return { ...action, knowledge: codeGuideAction(action, knowledge, platform, details.tags ?? [], settings.apiBase), truncated: false };
+  }
+  if (!knowledge) {
+    return { ...action, knowledge: NO_KNOWLEDGE, truncated: false };
+  }
+  const doc = parseSections(knowledge);
+  const digest = buildDigest(doc, { actionId: action.actionId });
+  if (!digest.truncated || doc.sections.length === 0) {
+    return { ...action, knowledge, truncated: false };
+  }
+  return {
+    ...action,
+    knowledge: [renderDigestBanner(digest), digest.markdown, renderDigestNotice(digest, action.actionId)].filter(Boolean).join("\n\n"),
+    truncated: true
+  };
+}
+async function find(requests, task, deps, settings, { knowledgeCatalog = false, knowledge = true } = {}) {
+  if (requests.length === 0 || requests.length > FIND_MAX_INTENTS) {
+    throw new FindArgsError(`Send between 1 and ${FIND_MAX_INTENTS} platform and intent pairs.`);
+  }
+  const empty = requests.find((r) => !r.platform.trim() || !r.intent.trim());
+  if (empty) {
+    throw new FindArgsError("Every request needs a platform and an intent.");
+  }
+  const platforms = await reachable(settings, deps);
+  const reaches = (platform) => platforms === null || platforms.includes(platform.toLowerCase());
+  const asked = requests.filter((r) => reaches(r.platform));
+  const answers = asked.length > 0 ? await deps.findActions(asked, task, settings.knowledgeAgent || knowledgeCatalog) : [];
+  if (answers.length !== asked.length) {
+    throw new Error(`One answered ${answers.length} of ${asked.length} requests; try again.`);
+  }
+  let next = 0;
+  const plans = requests.map((intent) => {
+    if (!reaches(intent.platform)) return { intent, unreachable: true };
+    const narrowed = narrow(answers[next++], settings);
+    const { answer } = narrowed;
+    const picks = knowledge && settings.knowledgeAgent ? answer.selected.slice(0, 1) : answer.selected;
+    return {
+      intent,
+      unreachable: false,
+      narrowed,
+      picks,
+      deferred: [...answer.selected.slice(picks.length), ...answer.alsoSelected ?? []],
+      runnerUpDocumented: knowledge && !settings.knowledgeAgent && answer.runnerUp !== void 0
+    };
+  });
+  const ids = /* @__PURE__ */ new Set();
+  for (const plan of plans) {
+    if (plan.unreachable || !knowledge) continue;
+    plan.picks.forEach((a) => ids.add(a.systemId));
+    if (plan.runnerUpDocumented && plan.narrowed.answer.runnerUp) ids.add(plan.narrowed.answer.runnerUp.systemId);
+  }
+  const details = new Map(
+    await Promise.all(
+      [...ids].map(async (id) => {
+        try {
+          return [id, await deps.getActionDetails(id)];
+        } catch (error2) {
+          return [id, error2 instanceof Error ? error2 : new Error(String(error2))];
+        }
+      })
+    )
+  );
+  let used = 0;
+  let served = false;
+  const admit = (doc) => {
+    if (served && used + doc.knowledge.length > FIND_DOCUMENTS_BUDGET) return false;
+    used += doc.knowledge.length;
+    served = true;
+    return true;
+  };
+  const result = plans.map((plan) => {
+    if (plan.unreachable) {
+      return {
+        ...plan.intent,
+        status: `Platform "${plan.intent.platform}" has no allowed connections for this CLI.`,
+        selected: [],
+        alsoSelected: [],
+        alternatives: []
+      };
+    }
+    const { answer } = plan.narrowed;
+    const selected = knowledge ? [] : plan.picks.map(ref);
+    const deferred = [];
+    for (const [index, pick] of (knowledge ? plan.picks : []).entries()) {
+      const doc = document(ref(pick), details.get(pick.systemId) ?? new Error("not fetched"), plan.intent.platform, settings);
+      if (!admit(doc)) {
+        deferred.push(...plan.picks.slice(index).map(ref));
+        break;
+      }
+      selected.push(doc);
+    }
+    return {
+      ...plan.intent,
+      status: status(answer, plan.narrowed),
+      selector: answer.selector,
+      ...answer.confidence !== void 0 ? { confidence: answer.confidence } : {},
+      selected,
+      alsoSelected: [...deferred, ...plan.deferred.map(ref)],
+      ...answer.runnerUp ? { runnerUp: ref(answer.runnerUp) } : {},
+      alternatives: answer.alternatives.map(ref)
+    };
+  });
+  plans.forEach((plan, index) => {
+    if (plan.unreachable || !plan.runnerUpDocumented || !plan.narrowed.answer.runnerUp) return;
+    const runnerUp = plan.narrowed.answer.runnerUp;
+    const doc = document(ref(runnerUp), details.get(runnerUp.systemId) ?? new Error("not fetched"), plan.intent.platform, settings);
+    if (used + doc.knowledge.length <= FIND_DOCUMENTS_BUDGET) {
+      used += doc.knowledge.length;
+      result[index].runnerUp = doc;
+    }
+  });
+  const documented = result.some((a) => a.selected.some((s) => "knowledge" in s) || a.runnerUp && "knowledge" in a.runnerUp);
+  return { answers: result, ...documented ? { guide: closingGuide(settings) } : {} };
+}
+async function load(actionIds, options, deps, settings) {
+  if (actionIds.length === 0 || actionIds.length > FIND_MAX_LOADS) {
+    throw new FindArgsError(`Load between 1 and ${FIND_MAX_LOADS} actions at once.`);
+  }
+  const platforms = await reachable(settings, deps);
+  const entries = await Promise.all(
+    actionIds.map(async (actionId) => {
+      const refused = { actionId, error: REFUSED_LOAD };
+      if (!isActionAllowed(actionId, settings.actionIds)) return refused;
+      const details = await deps.getActionDetails(actionId).catch(() => void 0);
+      if (!details || !isMethodAllowed(details.method, settings.permissions)) return refused;
+      const platform = details.connectionPlatform ?? "";
+      if (platforms !== null && platform && !platforms.includes(platform.toLowerCase())) return refused;
+      const action = { actionId, title: details.title, method: details.method, path: details.path };
+      if (settings.knowledgeAgent) {
+        return document(action, details, platform, settings);
+      }
+      return { ...action, ...part(details.knowledge, actionId, options) };
+    })
+  );
+  let used = 0;
+  let served = false;
+  const loaded = entries.map((entry) => {
+    if ("error" in entry) return entry;
+    if (served && used + entry.knowledge.length > FIND_DOCUMENTS_BUDGET) {
+      return { actionId: entry.actionId, error: "too large to serve beside the others; load it on its own" };
+    }
+    used += entry.knowledge.length;
+    served = true;
+    return entry;
+  });
+  const documented = loaded.some((e) => !("error" in e));
+  return { loaded, ...documented ? { guide: closingGuide(settings) } : {} };
+}
+function part(knowledge, actionId, options) {
+  if (!knowledge) return { knowledge: NO_KNOWLEDGE, truncated: false };
+  const doc = parseSections(knowledge);
+  const names = parseSectionFlag(options.section);
+  const specific = names.filter((n) => n.toLowerCase() !== "all");
+  if (specific.length > 0) {
+    const picked = selectSections(doc, specific);
+    if (!picked.ok) {
+      const toc = collapseSections(picked.candidates);
+      const listing = toc.sections.map((c) => `${c.heading} [${c.id}] (${c.chars} chars${c.children ? `, +${c.children} nested` : ""})`).join("\n");
+      const lead = picked.reason === "ambiguous" ? `Section "${picked.query}" matches several sections; pick one by id or full heading.` : `No section named "${picked.query}". Use one of the names below, or --full.`;
+      return { knowledge: `${lead}
+
+${listing}`, truncated: true };
+    }
+    return { knowledge: picked.markdown, truncated: true };
+  }
+  if (options.toc) {
+    const listing = flattenSections(doc.sections).map((s) => `${"  ".repeat(Math.max(0, s.level - 1))}${s.heading} [${s.id}] (${s.chars} chars)`).join("\n");
+    return {
+      knowledge: `Table of contents. Load any with: one --agent actions load ${actionId} --section "<id or heading>", or the whole document with --full.
+
+${listing || "(this document has no sections)"}`,
+      truncated: true
+    };
+  }
+  if (options.full === true || names.length > 0) {
+    return { knowledge, truncated: false };
+  }
+  const digest = buildDigest(doc, { actionId });
+  if (!digest.truncated || doc.sections.length === 0) return { knowledge, truncated: false };
+  return {
+    knowledge: [renderDigestBanner(digest), digest.markdown, renderDigestNotice(digest, actionId)].filter(Boolean).join("\n\n"),
+    truncated: true
+  };
+}
+function closingGuide(settings) {
+  return settings.knowledgeAgent ? codeGuideRules() : EXECUTE_GUIDE;
+}
+function platformEnvSegment(platform) {
+  const segment = platform.toUpperCase().split(/[^A-Z0-9]+/).filter(Boolean).join("_");
+  return segment || "PLATFORM";
+}
+var CUSTOM_ACTION_NOTE = '\n\nThis is a custom action: ALSO include "connectionKey" (the same value as the x-one-connection-key header) as a field in the JSON body for non-GET requests.';
+function codeGuideAction(action, knowledge, platform, tags, apiBase) {
+  const base = apiBase.replace(/\/$/, "");
+  const method = action.method.toUpperCase();
+  const path14 = action.path.startsWith("/") ? action.path : `/${action.path}`;
+  const connEnv = `ONE_${platformEnvSegment(platform)}_CONNECTION_KEY`;
+  const customNote = tags.includes("custom") ? CUSTOM_ACTION_NOTE : "";
+  return `### ${actionHeading(action)}
+**Platform:** ${platform}
+
+${knowledge ?? NO_KNOWLEDGE}
+
+## Calling this action from code
+URL:    ${base}/passthrough${path14}
+Method: ${method}
+Headers:
+- x-one-secret: the value of the ONE_SECRET env var
+- x-one-connection-key: the value of the ${connEnv} env var
+- x-one-action-id: ${action.actionId}
+- Content-Type: application/json${customNote}
+
+Environment variables: ONE_SECRET (their One API key) and ${connEnv} (the key of their ${platform} connection), both from the One dashboard.
+
+\`\`\`typescript
+const response = await fetch("${base}/passthrough${path14}", {
+method: "${method}",
+headers: {
+"x-one-secret": process.env.ONE_SECRET,
+"x-one-connection-key": process.env.${connEnv},
+"x-one-action-id": "${action.actionId}",
+"Content-Type": "application/json",
+},
+// body: JSON.stringify(...) - only for non-GET requests
+});
+\`\`\``;
+}
+function codeGuideRules() {
+  return `================================================================
+INTEGRATION CODE GUIDE - using these actions in an application
+================================================================
+You are in knowledge mode: actions cannot be executed here. Use this
+guide, with each action's "Calling this action from code", to write
+integration code in the user's project.
+
+## 1. Where this code must live
+Server-side only - an API route, edge function, or backend handler
+(e.g. Supabase Edge Function, Next.js route handler, Express route).
+NEVER call this API from browser/client code and NEVER hardcode secret
+values in source - read them from environment variables.
+
+## 2. The request
+All calls go through the One Passthrough API. Do NOT call the third-party
+API URL from the documentation directly. The URL is the One base plus the
+action path ONLY:
+\u2705 {One base}/v1/passthrough{action path}   (the path starts with /)
+\u274C {One base}/v1/passthrough/https://some-vendor-api.com{action path}
+
+## 3. Parameter placement
+Per each action's documentation:
+- Path variables (placeholders like {{userId}} in the path) \u2192 substitute
+  real values into the URL path; never send them in the body.
+- Query parameters \u2192 the URL query string, not the body.
+- Body fields \u2192 the JSON request body (POST/PUT/PATCH only).
+
+## 4. Environment variables & deployment
+The code will not work until the user sets each action's environment
+variables in their hosting platform's secrets manager (Supabase secrets,
+Vercel/Netlify environment settings, or the project's env settings -
+never committed to code). When you deliver the code, explicitly tell the
+user to set them.
+
+## 5. Code generation rules
+- Use TypeScript unless the user asked for another language.
+- Include the complete input/output structure from the documentation
+  (required/optional fields, types) in the implementation.
+- Handle errors: on a non-2xx response, read the response body and
+  surface a useful message.`;
+}
+function renderFind(result) {
+  const listing = (lead, actions2) => actions2.length === 0 ? [] : [`${lead} (load with \`one actions load <actionId>\`):
+${actions2.map((a) => `- ${actionHeading(a)}`).join("\n")}`];
+  const shown = (doc) => doc.knowledge.startsWith("### ") ? doc.knowledge : `### ${actionHeading(doc)}
+
+${doc.knowledge}`;
+  const sections = result.answers.map((answer) => {
+    const parts = [`## ${answer.platform}: ${answer.intent}
+
+${answer.status}`];
+    const documented = answer.selected.filter((s) => "knowledge" in s);
+    parts.push(...documented.map(shown));
+    parts.push(...listing("Chosen for this intent", answer.selected.filter((s) => !("knowledge" in s))));
+    parts.push(
+      ...listing(
+        answer.selected.length === 0 ? "Chosen for this intent, documentation left out to keep the answer small" : "Also chosen for this intent, documentation left out to keep the answer small",
+        answer.alsoSelected
+      )
+    );
+    if (answer.runnerUp) {
+      const lead = "If the chosen action does not fit, use this one instead: one or the other, never both";
+      parts.push(..."knowledge" in answer.runnerUp ? [`${lead}.
+
+${shown(answer.runnerUp)}`] : listing(lead, [answer.runnerUp]));
+    }
+    parts.push(...listing("Alternatives, not documented", answer.alternatives));
+    return parts.join("\n\n");
+  });
+  return [...sections, ...result.guide ? [result.guide] : []].join("\n\n---\n\n");
+}
+function renderLoad(result) {
+  const entries = result.loaded.map(
+    (entry) => "error" in entry ? `\`${entry.actionId}\`: ${entry.error}` : entry.knowledge.startsWith("### ") ? entry.knowledge : `### ${actionHeading(entry)}
+
+${entry.knowledge}`
+  );
+  return [...entries, ...result.guide ? [result.guide] : []].join("\n\n---\n\n");
+}
+
 // src/commands/actions.ts
 function getConfig() {
   const apiKey = getApiKey();
@@ -3513,312 +3893,101 @@ function parseJsonArg2(value, argName) {
     error(`Invalid JSON for ${argName}: ${value}`);
   }
 }
-async function actionsSearchCommand(platform, query, options) {
+function findDeps(api, connectionKeys, useCache) {
+  return {
+    findActions: (requests, task, knowledgeAgent) => api.findActions(requests, task, knowledgeAgent),
+    getActionDetails: async (actionId) => (await resolveActionDetails(api, actionId, { useCache })).details,
+    connectedPlatforms: async () => (await api.listConnections()).filter((c) => connectionKeys.includes(c.key)).map((c) => c.platform)
+  };
+}
+function failure(error2) {
+  if (error2 instanceof ApiError) {
+    try {
+      const body = JSON.parse(error2.message);
+      if (body.message) return body.message;
+    } catch {
+    }
+  }
+  return error2 instanceof Error ? error2.message : "Unknown error";
+}
+async function actionsFindCommand(pairs, options) {
   intro(pc8.bgCyan(pc8.black(" One ")));
-  const { apiKey, permissions, actionIds, knowledgeAgent } = getConfig();
+  if (options.type !== void 0 && options.type !== "execute" && options.type !== "knowledge") {
+    error("--type must be execute or knowledge.");
+  }
+  if (pairs.length === 0 || pairs.length % 2 !== 0) {
+    error('Pass platform and intent pairs: one actions find <platform> "<intent>" [<platform> "<intent>" ...]');
+  }
+  const requests = [];
+  for (let i = 0; i < pairs.length; i += 2) {
+    requests.push({ platform: pairs[i], intent: pairs[i + 1] });
+  }
+  const { apiKey, permissions, connectionKeys, actionIds, knowledgeAgent } = getConfig();
   const api = new OneApi(apiKey, getApiBase());
+  const settings = { knowledgeAgent, permissions, actionIds, connectionKeys, apiBase: getApiBase() };
   const spinner4 = createSpinner();
-  spinner4.start(`Searching actions on ${pc8.cyan(platform)} for "${query}"...`);
+  spinner4.start(`Finding actions for ${requests.length} intent${requests.length === 1 ? "" : "s"}...`);
   try {
-    const agentType = knowledgeAgent ? "knowledge" : options.type || "execute";
-    const useCache = options.cache !== false;
-    const searchType = agentType || "knowledge";
-    const cachePath = searchCachePath(platform, query, searchType);
-    const cached2 = useCache ? readCache(cachePath) : null;
-    let cleanedActions;
-    let cacheHit = false;
-    if (cached2 && isFresh(cached2)) {
-      cleanedActions = cached2.data.actions;
-      cacheHit = true;
-    } else {
-      try {
-        const result = await api.searchActionsWithMeta(
-          platform,
-          query,
-          agentType,
-          cached2?.etag ?? void 0
-        );
-        if (result.status === 304 && cached2) {
-          cached2.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-          writeCache(cachePath, cached2);
-          cleanedActions = cached2.data.actions;
-          cacheHit = true;
-        } else {
-          let actions2 = result.data;
-          actions2 = filterByPermissions(actions2, permissions);
-          actions2 = actions2.filter((a) => isActionAllowed(a.systemId, actionIds));
-          cleanedActions = actions2.map((action) => ({
-            actionId: action.systemId,
-            title: action.title,
-            method: action.method,
-            path: action.path
-          }));
-          writeCache(cachePath, makeCacheEntry(
-            `${platform}_${query}_${searchType}`,
-            { actions: cleanedActions, platform, query, searchType },
-            result.etag
-          ));
-        }
-      } catch (fetchError) {
-        if (cached2) {
-          process.stderr.write(
-            `Warning: serving cached search results (network unavailable, cached ${formatAge(getAge(cached2))} ago)
-`
-          );
-          cleanedActions = cached2.data.actions;
-          cacheHit = true;
-        } else {
-          throw fetchError;
-        }
-      }
-    }
+    const result = await find(
+      requests,
+      options.task,
+      findDeps(api, connectionKeys, options.cache !== false),
+      settings,
+      { knowledgeCatalog: options.type === "knowledge", knowledge: options.knowledge !== false }
+    );
     if (isAgentMode()) {
-      const response = { actions: cleanedActions };
-      if (cacheHit && cached2) {
-        response._cache = buildCacheMeta(cached2, true);
-      } else {
-        const freshEntry = readCache(cachePath);
-        response._cache = buildCacheMeta(freshEntry, false);
-      }
-      json(response);
-      return;
-    }
-    if (cleanedActions.length === 0) {
-      spinner4.stop("No actions found");
-      p6.note(
-        `No actions found for platform '${platform}' matching query '${query}'.
-
-Suggestions:
-  - Try a more general query (e.g., 'list', 'get', 'search', 'create')
-  - Verify the platform name is correct
-  - Check available platforms with ${pc8.cyan("one platforms")}
-
-Examples of good queries:
-  - "search contacts"
-  - "send email"
-  - "create customer"
-  - "list orders"`,
-        "No Results"
-      );
+      json(result);
       return;
     }
-    spinner4.stop(
-      `Found ${cleanedActions.length} action(s) for '${platform}' matching '${query}'`
-    );
+    spinner4.stop("Found");
     console.log();
-    const rows = cleanedActions.map((a) => ({
-      method: colorMethod(a.method),
-      title: a.title,
-      actionId: a.actionId,
-      path: a.path
-    }));
-    printTable(
-      [
-        { key: "method", label: "Method" },
-        { key: "title", label: "Title" },
-        { key: "actionId", label: "Action ID", color: pc8.dim },
-        { key: "path", label: "Path", color: pc8.dim }
-      ],
-      rows
-    );
+    console.log(renderFind(result));
     console.log();
-    p6.note(
-      `Get details: ${pc8.cyan(`one actions knowledge ${platform} <actionId>`)}
-Execute:     ${pc8.cyan(`one actions execute ${platform} <actionId> <connectionKey>`)}`,
-      "Next Steps"
-    );
   } catch (error2) {
-    spinner4.stop("Search failed");
-    error(
-      `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
-    );
+    spinner4.stop("Find failed");
+    error(`Error: ${failure(error2)}`);
   }
 }
-async function actionsKnowledgeCommand(platform, actionId, options) {
-  const cachePath = knowledgeCachePath(actionId);
+async function actionsLoadCommand(actionIds, options) {
   if (options.cacheStatus) {
-    const entry = readCache(cachePath);
-    if (!entry) {
-      json({
-        cached: false,
-        path: cachePath
-      });
-    } else {
-      const age = getAge(entry);
-      json({
-        cached: true,
-        cachedAt: entry.cachedAt,
-        age: formatAge(age),
-        ttl: entry.ttl,
-        expired: !isFresh(entry),
-        etag: entry.etag,
-        path: cachePath
-      });
-    }
+    json(
+      actionIds.map((actionId) => {
+        const cachePath = knowledgeCachePath(actionId);
+        const entry = readCache(cachePath);
+        if (!entry) return { actionId, cached: false, path: cachePath };
+        return {
+          actionId,
+          cached: true,
+          cachedAt: entry.cachedAt,
+          age: formatAge(getAge(entry)),
+          ttl: entry.ttl,
+          expired: !isFresh(entry),
+          etag: entry.etag,
+          path: cachePath
+        };
+      })
+    );
     return;
   }
   intro(pc8.bgCyan(pc8.black(" One ")));
-  const { apiKey, actionIds, connectionKeys } = getConfig();
+  const { apiKey, permissions, connectionKeys, actionIds: allowed, knowledgeAgent } = getConfig();
   const api = new OneApi(apiKey, getApiBase());
-  if (!isActionAllowed(actionId, actionIds)) {
-    error(`Action "${actionId}" is not in the allowed action list.`);
-  }
-  if (!connectionKeys.includes("*")) {
-    const spinner5 = createSpinner();
-    spinner5.start("Checking connections...");
-    try {
-      const connections = await api.listConnections();
-      const connectedPlatforms = connections.map((c) => c.platform);
-      if (!connectedPlatforms.includes(platform)) {
-        spinner5.stop("Platform not connected");
-        error(`Platform "${platform}" has no allowed connections.`);
-      }
-      spinner5.stop("Connection verified");
-    } catch (error2) {
-      spinner5.stop("Failed to check connections");
-      error(
-        `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
-      );
-    }
-  }
+  const settings = { knowledgeAgent, permissions, actionIds: allowed, connectionKeys, apiBase: getApiBase() };
   const spinner4 = createSpinner();
-  spinner4.start(`Loading knowledge for action ${pc8.dim(actionId)}...`);
+  spinner4.start(`Loading ${actionIds.length === 1 ? "the action" : `${actionIds.length} actions`}...`);
   try {
-    const { details, cacheHit, entry } = await resolveActionDetails(api, actionId, {
-      useCache: options.cache !== false
-    });
-    const knowledgeData = {
-      knowledge: details.knowledge || "No knowledge was found",
-      method: details.method || "No method was found"
-    };
-    const doc = parseSections(knowledgeData.knowledge);
-    const sectionNames = parseSectionFlag(options.section);
-    const wantFull = options.full === true || sectionNames.some((n) => n.toLowerCase() === "all");
-    const base = `one --agent actions knowledge ${platform} ${actionId}`;
-    const fullToc = flattenSections(doc.sections).map((s) => ({ id: s.id, heading: s.heading, level: s.level, chars: s.chars }));
-    if (options.toc) {
-      if (isAgentMode()) {
-        json({
-          title: doc.title,
-          method: knowledgeData.method,
-          chars: doc.chars,
-          sections: fullToc,
-          more: { section: `${base} --section <id or heading>[,<id or heading>...]`, full: `${base} --full` },
-          _cache: buildCacheMeta(entry, cacheHit)
-        });
-        return;
-      }
-      spinner4.stop("Sections");
-      console.log();
-      for (const t of fullToc) console.log(`${"  ".repeat(Math.max(0, t.level - 1))}${t.heading} ${pc8.dim(`[${t.id}] ${t.chars} chars`)}`);
-      console.log();
-      return;
-    }
-    if (sectionNames.length > 0 && !wantFull) {
-      const picked = selectSections(doc, sectionNames);
-      if (!picked.ok) {
-        const toc = collapseSections(picked.candidates);
-        const list = toc.sections.map((c) => `${"  ".repeat(Math.max(0, c.level - 2))}${c.heading} [${c.id}] (${c.chars} chars${c.children ? `, +${c.children} nested` : ""})`).join("\n");
-        if (isAgentMode()) {
-          json({
-            error: picked.reason === "ambiguous" ? `Section "${picked.query}" matches several sections; pick one by id or full heading.` : `No section named "${picked.query}". Use one of the ids or headings below, or --full.`,
-            query: picked.query,
-            reason: picked.reason,
-            sections: toc.sections.map(({ id, heading, level, chars, children }) => children ? { id, heading, level, chars, children } : { id, heading, level, chars }),
-            ...toc.collapsed ? { sectionsCollapsed: true, sectionCount: picked.candidates.length } : {},
-            hint: `${base} --section <id or heading>`,
-            toc: `${base} --toc`
-          });
-          process.exit(1);
-        }
-        spinner4.stop("Section not found");
-        error(`${picked.reason === "ambiguous" ? "Ambiguous" : "Unknown"} section "${picked.query}". Available:
-${list}`);
-      }
-      if (isAgentMode()) {
-        json({
-          knowledge: picked.markdown,
-          method: knowledgeData.method,
-          title: doc.title,
-          // The requested sections are returned whole; nothing here was cut.
-          truncated: false,
-          requested: sectionNames,
-          // What each name matched — fuzzy and alias matches are visible here.
-          resolved: picked.sections.map((s) => ({ id: s.id, heading: s.heading, chars: s.chars })),
-          sectionCount: fullToc.length,
-          more: {
-            note: "Only the requested sections are included. The digest call listed the others; `--toc` lists all of them.",
-            section: `${base} --section <id or heading>[,<id or heading>...]`,
-            toc: `${base} --toc`,
-            full: `${base} --full`
-          },
-          _cache: buildCacheMeta(entry, cacheHit)
-        });
-        return;
-      }
-      spinner4.stop("Sections loaded");
-      console.log();
-      console.log(picked.markdown);
-      console.log();
-      return;
-    }
-    const digest = buildDigest(
-      doc,
-      isAgentMode() && !wantFull ? {} : { wholeDocThreshold: Number.POSITIVE_INFINITY }
-    );
-    const body = doc.sections.length === 0 ? knowledgeData.knowledge : digest.markdown;
-    const notice = renderDigestNotice(digest, platform, actionId);
-    const banner = renderDigestBanner(digest);
-    const knowledgeWithGuidance = buildActionKnowledgeWithGuidance(
-      notice ? `${banner}
-
-${body}
-
-${notice}` : body,
-      knowledgeData.method,
-      platform,
-      actionId
-    );
+    const result = await load(actionIds, options, findDeps(api, connectionKeys, options.cache !== false), settings);
     if (isAgentMode()) {
-      const response = {
-        knowledge: knowledgeWithGuidance,
-        method: knowledgeData.method,
-        title: doc.title || void 0,
-        truncated: digest.truncated,
-        _cache: buildCacheMeta(entry, cacheHit)
-      };
-      if (digest.truncated) {
-        const toc = omittedSections(digest);
-        response.omitted = digest.omitted;
-        response.omittedChars = digest.omittedChars;
-        response.sections = toc.sections;
-        if (toc.collapsed) {
-          response.sectionsCollapsed = true;
-          response.sectionCount = digest.sections.length;
-        }
-        response.more = {
-          note: toc.collapsed ? `This is a digest. \`sections\` lists what was omitted, collapsed to ${toc.sections.length} entries (\`children\` counts nested ones); request any by id or heading, or --toc for all ${digest.sections.length} headings.` : "This is a digest. `sections` lists what was omitted; request any by id or heading.",
-          section: `${base} --section <id or heading>[,<id or heading>...]`,
-          toc: `${base} --toc`,
-          full: `${base} --full`
-        };
-      }
-      json(response);
+      json(result);
       return;
     }
-    spinner4.stop("Knowledge loaded");
+    spinner4.stop("Loaded");
     console.log();
-    console.log(knowledgeWithGuidance);
+    console.log(renderLoad(result));
     console.log();
-    p6.note(
-      `Execute: ${pc8.cyan(`one actions execute ${platform} ${actionId} <connectionKey>`)}`,
-      "Next Step"
-    );
   } catch (error2) {
-    spinner4.stop("Failed to load knowledge");
-    error(
-      `Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`
-    );
+    spinner4.stop("Load failed");
+    error(`Error: ${failure(error2)}`);
   }
 }
 async function actionsExecuteCommand(platform, actionId, connectionKey, options) {
@@ -4275,22 +4444,6 @@ async function actionsExecuteParallelCommand() {
   }
   console.log();
 }
-function colorMethod(method) {
-  switch (method.toUpperCase()) {
-    case "GET":
-      return pc8.green(method);
-    case "POST":
-      return pc8.yellow(method);
-    case "PUT":
-      return pc8.blue(method);
-    case "PATCH":
-      return pc8.magenta(method);
-    case "DELETE":
-      return pc8.red(method);
-    default:
-      return method;
-  }
-}
 
 // src/commands/flow.ts
 import pc9 from "picocolors";
@@ -5049,14 +5202,14 @@ function previewValue(value, max = 120) {
   if (str === void 0) str = String(value);
   return str.length > max ? `${str.slice(0, max - 1)}\u2026` : str;
 }
-function renderDryRef(ref) {
-  if (ref.status === "resolved") {
-    return `${pc9.green("\u2713")} ${ref.selector} ${pc9.dim("\u2192")} ${previewValue(ref.value)}`;
+function renderDryRef(ref2) {
+  if (ref2.status === "resolved") {
+    return `${pc9.green("\u2713")} ${ref2.selector} ${pc9.dim("\u2192")} ${previewValue(ref2.value)}`;
   }
-  if (ref.status === "deferred") {
-    return `${pc9.dim("\u25CB")} ${ref.selector} ${pc9.dim("\u2192 pending (produced by a later step)")}`;
+  if (ref2.status === "deferred") {
+    return `${pc9.dim("\u25CB")} ${ref2.selector} ${pc9.dim("\u2192 pending (produced by a later step)")}`;
   }
-  return `${pc9.yellow("!")} ${ref.selector} ${pc9.yellow("\u2192 unresolved \u2014 check the input/env name")}`;
+  return `${pc9.yellow("!")} ${ref2.selector} ${pc9.yellow("\u2192 unresolved \u2014 check the input/env name")}`;
 }
 function renderDryResolution(steps) {
   const isExpr = (t) => t === "transform" || t === "condition" || t === "while";
@@ -5072,8 +5225,8 @@ function renderDryResolution(steps) {
       console.log(`      ${pc9.dim("=")} ${previewValue(s.resolved)}`);
     }
     if (!(isExpr(s.type) && s.deferred)) {
-      for (const ref of s.references) {
-        console.log(`      ${renderDryRef(ref)}`);
+      for (const ref2 of s.references) {
+        console.log(`      ${renderDryRef(ref2)}`);
       }
     }
     if (!isExpr(s.type) && s.references.length === 0 && s.error === void 0) {
@@ -5280,8 +5433,8 @@ ${pc9.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
       if (event.event === "step:start") {
         console.log(`  ${pc9.dim(ts)} ${pc9.cyan("\u25B6")} ${event.stepName} ${pc9.dim(`(${event.type})`)}`);
       } else if (event.event === "step:complete") {
-        const status = event.status === "success" ? pc9.green("\u2713") : event.status === "skipped" ? pc9.dim("\u25CB") : pc9.red("\u2717");
-        console.log(`  ${pc9.dim(ts)} ${status} ${event.stepId} ${pc9.dim(`${event.durationMs}ms`)}`);
+        const status2 = event.status === "success" ? pc9.green("\u2713") : event.status === "skipped" ? pc9.dim("\u25CB") : pc9.red("\u2717");
+        console.log(`  ${pc9.dim(ts)} ${status2} ${event.stepId} ${pc9.dim(`${event.durationMs}ms`)}`);
       } else if (event.event === "step:error") {
         console.log(`  ${pc9.dim(ts)} ${pc9.red("\u2717")} ${event.stepId}: ${event.error}`);
       }
@@ -5618,18 +5771,18 @@ async function flowInspectCommand(runId, options = {}) {
   console.log(`  ${pc9.dim(`Log:   ${path7.join(".one/flows/.logs", `${state.flowKey}-${state.runId}.log`)}`)}`);
   console.log();
 }
-function colorStatus(status) {
-  switch (status) {
+function colorStatus(status2) {
+  switch (status2) {
     case "completed":
-      return pc9.green(status);
+      return pc9.green(status2);
     case "running":
-      return pc9.cyan(status);
+      return pc9.cyan(status2);
     case "paused":
-      return pc9.yellow(status);
+      return pc9.yellow(status2);
     case "failed":
-      return pc9.red(status);
+      return pc9.red(status2);
     default:
-      return status;
+      return status2;
   }
 }
 var SCAFFOLD_TEMPLATES = {
@@ -6156,7 +6309,7 @@ async function relayPlatformsCommand() {
         { key: "platform", label: "Platform" },
         { key: "eventTypeCount", label: "Event types", color: pc10.dim }
       ],
-      platforms.map((p10) => ({ platform: p10.platform, eventTypeCount: String(p10.eventTypeCount) }))
+      platforms.map((p9) => ({ platform: p9.platform, eventTypeCount: String(p9.eventTypeCount) }))
     );
     console.log();
     console.log(
@@ -6682,9 +6835,9 @@ function interpolate(template, record) {
   return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path14) => {
     const parts = path14.split(".");
     let value = record;
-    for (const part of parts) {
+    for (const part2 of parts) {
       if (typeof value !== "object" || value === null) return "";
-      value = value[part];
+      value = value[part2];
     }
     return value === null || value === void 0 ? "" : String(value);
   });
@@ -6711,9 +6864,9 @@ function deepMerge(target, source) {
 function getByDotPath2(obj, path14) {
   const parts = path14.split(".");
   let current = obj;
-  for (const part of parts) {
+  for (const part2 of parts) {
     if (current === null || current === void 0 || typeof current !== "object") return void 0;
-    current = current[part];
+    current = current[part2];
   }
   return current;
 }
@@ -6868,7 +7021,7 @@ async function enrichPhase(api, db, config2, model, idField, connectionKey, plat
   }
   if (detailAction.tags?.includes("custom")) {
     throw new Error(
-      `Enrich does not support custom actions. Action ${config2.actionId} is tagged "custom". Use a passthrough detail endpoint \u2014 run 'one actions search ${platform} "<model> get"' to find one.`
+      `Enrich does not support custom actions. Action ${config2.actionId} is tagged "custom". Use a passthrough detail endpoint \u2014 run 'one actions find ${platform} "get a <model>" -t knowledge' to find one.`
     );
   }
   let concurrency = config2.concurrency ?? DEFAULT_CONCURRENCY;
@@ -6915,16 +7068,16 @@ async function enrichPhase(api, db, config2, model, idField, connectionKey, plat
     }
     let writes = pending2;
     if (ctx.transform && pending2.length > 0) {
-      const transformed = await transformRecords(ctx.transform, pending2.map((p10) => p10.merged));
+      const transformed = await transformRecords(ctx.transform, pending2.map((p9) => p9.merged));
       if (transformed) {
         const byId = /* @__PURE__ */ new Map();
         for (const r of transformed) byId.set(r[idField], r);
         writes = [];
-        for (const p10 of pending2) {
-          const t = byId.get(p10.id);
+        for (const p9 of pending2) {
+          const t = byId.get(p9.id);
           if (!t) continue;
           if (!t[tsField]) t[tsField] = now;
-          writes.push({ merged: t, id: p10.id });
+          writes.push({ merged: t, id: p9.id });
         }
       }
     }
@@ -7312,7 +7465,7 @@ async function syncModel(api, profile, options) {
     const { details: actionDetails } = await resolveActionDetails(api, profile.actionId);
     if (actionDetails.tags?.includes("custom")) {
       throw new Error(
-        `Sync does not support custom actions. Action ${profile.actionId} is tagged "custom". Use a passthrough action \u2014 run 'one actions search ${platform} "${model}"' to find one, or compose a flow that chains passthrough calls if the logic is complex.`
+        `Sync does not support custom actions. Action ${profile.actionId} is tagged "custom". Use a passthrough action \u2014 run 'one actions find ${platform} "list ${model}" -t knowledge' to find one, or compose a flow that chains passthrough calls if the logic is complex.`
       );
     }
     const maxPages = options.maxPages ?? Infinity;
@@ -7861,7 +8014,7 @@ async function testSyncProfile(api, profile) {
     checks.push({
       name: "action is passthrough (not custom)",
       ok: false,
-      detail: `Action ${profile.actionId} is tagged "custom". Sync only supports passthrough actions. Run 'one actions search ${profile.platform} "${profile.model}"' to find one.`
+      detail: `Action ${profile.actionId} is tagged "custom". Sync only supports passthrough actions. Run 'one actions find ${profile.platform} "list ${profile.model}" -t knowledge' to find one.`
     });
     return report;
   }
@@ -8716,7 +8869,7 @@ async function searchSyncedData(query, options) {
   const backend = await getBackend();
   const profiles = listProfiles(options.platform);
   const modelFilter = options.models ? new Set(options.models) : null;
-  const types = profiles.filter((p10) => !modelFilter || modelFilter.has(p10.model)).map((p10) => `${p10.platform}/${p10.model}`);
+  const types = profiles.filter((p9) => !modelFilter || modelFilter.has(p9.model)).map((p9) => `${p9.platform}/${p9.model}`);
   if (types.length === 0) {
     throw new Error(
       options.platform ? `No sync profiles found for ${options.platform}. Run 'one sync init ${options.platform} <model>' first.` : `No sync profiles configured. Run 'one sync init <platform> <model>' first.`
@@ -8872,7 +9025,7 @@ function suggestSearchablePaths(records, limit = 15) {
 
 // src/lib/memory/sync/index.ts
 import { spawn as spawn4 } from "child_process";
-import * as p7 from "@clack/prompts";
+import * as p6 from "@clack/prompts";
 import pc11 from "picocolors";
 async function syncInstallCommand() {
   if (await isSqliteAvailable()) {
@@ -8960,17 +9113,17 @@ async function syncProfilesCommand(platform) {
   const profiles = listBuiltinProfiles(platform);
   if (isAgentMode()) {
     json({
-      profiles: profiles.map((p10) => ({
-        platform: p10.platform,
-        model: p10.model,
-        description: p10.description,
-        hasEnrich: !!p10.enrich,
+      profiles: profiles.map((p9) => ({
+        platform: p9.platform,
+        model: p9.model,
+        description: p9.description,
+        hasEnrich: !!p9.enrich,
         // `identityKey` (singular) is the entity-merge key; `identityKeys`
         // (plural, #167) are non-merging association keys. Reading only the
         // singular reported hasIdentityKey:false for gmail/gcal/fathom — the
         // three profiles the plural form was added for. (#129/#130)
-        hasIdentityKey: !!p10.identityKey || !!p10.identityKeys,
-        hasIdentityKeys: !!p10.identityKeys
+        hasIdentityKey: !!p9.identityKey || !!p9.identityKeys,
+        hasIdentityKeys: !!p9.identityKeys
       })),
       total: profiles.length,
       _hint: profiles.length > 0 ? "Use a built-in profile: one --agent sync init <platform> <model>" : "No built-in profiles found. Use sync init to auto-infer from action knowledge."
@@ -8984,13 +9137,13 @@ async function syncProfilesCommand(platform) {
     );
     return;
   }
-  for (const p10 of profiles) {
+  for (const p9 of profiles) {
     const extras = [];
-    if (p10.enrich) extras.push("enrich");
-    if (p10.identityKey || p10.identityKeys) extras.push("identity");
-    if (p10.dateFilter) extras.push("incremental");
+    if (p9.enrich) extras.push("enrich");
+    if (p9.identityKey || p9.identityKeys) extras.push("identity");
+    if (p9.dateFilter) extras.push("incremental");
     const tags = extras.length > 0 ? ` ${pc11.dim(`[${extras.join(", ")}]`)}` : "";
-    console.log(`  ${pc11.bold(`${p10.platform}/${p10.model}`.padEnd(35))} ${p10.description}${tags}`);
+    console.log(`  ${pc11.bold(`${p9.platform}/${p9.model}`.padEnd(35))} ${p9.description}${tags}`);
   }
   console.log(`
 ${profiles.length} built-in profile(s). Run ${pc11.bold("one sync init <platform> <model>")} to use one.`);
@@ -9101,7 +9254,7 @@ async function syncInitCommand(platform, model, options) {
         } catch {
         }
       }
-      const hint = isComplete ? testReport?.ok ? `Profile complete and validated. Run: one sync run ${platform} --models ${model}` : `Profile complete but test had issues \u2014 check the test report below.` : actionId ? `Fill remaining FILL_IN fields, then: one sync test ${platform}/${model}` : `Action ID not resolved. Run: one --agent actions search ${platform} "list ${model}" -t execute`;
+      const hint = isComplete ? testReport?.ok ? `Profile complete and validated. Run: one sync run ${platform} --models ${model}` : `Profile complete but test had issues \u2014 check the test report below.` : actionId ? `Fill remaining FILL_IN fields, then: one sync test ${platform}/${model}` : `Action ID not resolved. Run: one --agent actions find ${platform} "list ${model}" -t knowledge`;
       if (isAgentMode()) {
         json({
           ...template,
@@ -9249,11 +9402,11 @@ async function syncTestCommand(platformModel, options = {}) {
     console.log(`    ${pc11.dim("text:")}    ${searchablePreview.text.slice(0, 300)}${searchablePreview.length > 300 ? pc11.dim(" \u2026") : ""}`);
     if (searchablePreview.paths) {
       console.log(`    ${pc11.dim("paths:")}  ${pc11.dim('(hit rate across all samples \u2014 differentiates "wrong path" from "field sometimes missing")')}`);
-      for (const p10 of searchablePreview.paths) {
-        const rate = `${p10.hits}/${p10.total}`;
-        const mark = p10.hits === p10.total ? pc11.green("\u2713") : p10.hits === 0 ? pc11.red("\u2717") : pc11.yellow("~");
-        const trailer = p10.sample ? pc11.dim(` \u2192 "${p10.sample}"`) : p10.hits === 0 ? pc11.dim(" (no sample matched \u2014 typo, or field never populated in this page)") : "";
-        console.log(`      ${mark} ${rate.padStart(5)} ${p10.path}${trailer}`);
+      for (const p9 of searchablePreview.paths) {
+        const rate = `${p9.hits}/${p9.total}`;
+        const mark = p9.hits === p9.total ? pc11.green("\u2713") : p9.hits === 0 ? pc11.red("\u2717") : pc11.yellow("~");
+        const trailer = p9.sample ? pc11.dim(` \u2192 "${p9.sample}"`) : p9.hits === 0 ? pc11.dim(" (no sample matched \u2014 typo, or field never populated in this page)") : "";
+        console.log(`      ${mark} ${rate.padStart(5)} ${p9.path}${trailer}`);
       }
     } else {
       console.log(`    ${pc11.yellow("note:")} no memory.searchable declared \u2014 using the default walker (walks every field, often noisy).`);
@@ -9273,10 +9426,10 @@ function buildSearchablePreview(profile, samples) {
     const perPathAgg = paths.map((path14) => ({ path: path14, hits: 0, total: samples.length, sample: "" }));
     for (const record of samples) {
       const { paths: perPath } = extractSearchableFromPaths(record, paths);
-      perPath.forEach((p10, i) => {
-        if (p10.found) {
+      perPath.forEach((p9, i) => {
+        if (p9.found) {
           perPathAgg[i].hits++;
-          if (!perPathAgg[i].sample) perPathAgg[i].sample = p10.sample;
+          if (!perPathAgg[i].sample) perPathAgg[i].sample = p9.sample;
         }
       });
     }
@@ -9290,16 +9443,16 @@ async function syncRunCommand(platform, options) {
   const api = getApi();
   const profiles = listProfiles(platform);
   const targetModels = options.models;
-  const toSync = targetModels ? profiles.filter((p10) => targetModels.includes(p10.model)) : profiles;
+  const toSync = targetModels ? profiles.filter((p9) => targetModels.includes(p9.model)) : profiles;
   if (toSync.length === 0) {
     error(
       `No sync profiles found for ${platform}` + (targetModels ? ` with models: ${targetModels.join(", ")}` : "") + `. Run 'one sync init ${platform} <model> --config ...' first.`
     );
   }
   if (!options.dryRun) {
-    await maybeAutoMigrateLegacy(platform, toSync.map((p10) => p10.model));
+    await maybeAutoMigrateLegacy(platform, toSync.map((p9) => p9.model));
   }
-  const profileDrift = toSync.map((p10) => ({ model: p10.model, missing: findMissingBuiltinCapabilities(platform, p10.model, p10) })).filter((d) => d.missing.length > 0);
+  const profileDrift = toSync.map((p9) => ({ model: p9.model, missing: findMissingBuiltinCapabilities(platform, p9.model, p9) })).filter((d) => d.missing.length > 0);
   if (profileDrift.length > 0 && !isAgentMode()) {
     for (const d of profileDrift) {
       console.log(
@@ -9347,8 +9500,8 @@ async function syncRunCommand(platform, options) {
     return;
   }
   for (const r of results) {
-    const status = r.status === "complete" ? pc11.green("complete") : r.status === "dry-run" ? pc11.yellow("dry-run") : pc11.red("failed");
-    console.log(`  ${pc11.bold(r.model)} \u2014 ${r.recordsSynced} records, ${r.pagesProcessed} pages, ${r.duration} [${status}]`);
+    const status2 = r.status === "complete" ? pc11.green("complete") : r.status === "dry-run" ? pc11.yellow("dry-run") : pc11.red("failed");
+    console.log(`  ${pc11.bold(r.model)} \u2014 ${r.recordsSynced} records, ${r.pagesProcessed} pages, ${r.duration} [${status2}]`);
     if (r.reconcileSkipped) {
       console.log(`    ${pc11.yellow("--full-refresh reconcile skipped \u2014 pagination truncated (e.g. --max-pages). Re-run without the cap to prune stale rows.")}`);
     }
@@ -9475,8 +9628,8 @@ async function syncDeleteCommand(platformModel, options) {
       return;
     }
     if (!options.yes && !isAgentMode()) {
-      const confirmed = await p7.confirm({ message: `Delete ${preview.count} record(s) from ${platform}/${model}?` });
-      if (p7.isCancel(confirmed) || !confirmed) {
+      const confirmed = await p6.confirm({ message: `Delete ${preview.count} record(s) from ${platform}/${model}?` });
+      if (p6.isCancel(confirmed) || !confirmed) {
         db.close();
         cancel("Cancelled.");
         return;
@@ -9518,11 +9671,11 @@ async function maybeAutoMigrateLegacy(platform, models) {
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
-  const shouldMigrate = await p7.confirm({
+  const shouldMigrate = await p6.confirm({
     message: `Found legacy .one/sync/data/${platform}.db (${dbSize}) with no corresponding memory records. Migrate into the unified memory store before syncing?`,
     initialValue: true
   });
-  if (p7.isCancel(shouldMigrate) || !shouldMigrate) return;
+  if (p6.isCancel(shouldMigrate) || !shouldMigrate) return;
   const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-TACDLGPD.js");
   await memMigrateCommand2({ platform, yes: true });
 }
@@ -9586,14 +9739,14 @@ async function syncListCommand(platform) {
   const state = await readSyncState();
   const { getBackend: getBackend2 } = await import("./runtime-SX36HGBA.js");
   const backend = await getBackend2();
-  const syncs = await Promise.all(profiles.map(async (p10) => {
-    const modelState = state[p10.platform]?.[p10.model];
-    const type = `${p10.platform}/${p10.model}`;
+  const syncs = await Promise.all(profiles.map(async (p9) => {
+    const modelState = state[p9.platform]?.[p9.model];
+    const type = `${p9.platform}/${p9.model}`;
     const totalRecords = await backend.count(type, { status: "active" }).catch(() => 0);
-    const legacyDbSize = getDatabaseSize(p10.platform);
+    const legacyDbSize = getDatabaseSize(p9.platform);
     return {
-      platform: p10.platform,
-      model: p10.model,
+      platform: p9.platform,
+      model: p9.model,
       lastSync: modelState?.lastSync ?? null,
       totalRecords,
       pagesProcessed: modelState?.pagesProcessed ?? 0,
@@ -9613,10 +9766,10 @@ async function syncListCommand(platform) {
     return;
   }
   for (const s of syncs) {
-    const status = s.status === "idle" ? pc11.green("idle") : s.status === "syncing" ? pc11.yellow(`syncing \u2014 page ${s.pagesProcessed}`) : pc11.red("failed");
+    const status2 = s.status === "idle" ? pc11.green("idle") : s.status === "syncing" ? pc11.yellow(`syncing \u2014 page ${s.pagesProcessed}`) : pc11.red("failed");
     const legacy = s.legacyDbSize && s.legacyDbSize !== "0 B" ? pc11.yellow(`  legacy .db ${s.legacyDbSize}`) : "";
     console.log(
-      `  ${pc11.bold(`${s.platform}/${s.model}`.padEnd(35))} ${String(s.totalRecords).padStart(8)} records  ${status}  ${pc11.dim(s.lastSync ? `last: ${s.lastSync}` : "never synced")}` + legacy
+      `  ${pc11.bold(`${s.platform}/${s.model}`.padEnd(35))} ${String(s.totalRecords).padStart(8)} records  ${status2}  ${pc11.dim(s.lastSync ? `last: ${s.lastSync}` : "never synced")}` + legacy
     );
   }
 }
@@ -9624,7 +9777,7 @@ async function syncRemoveCommand(platform, options) {
   const modelList = options.models?.split(",").map((m) => m.trim());
   const preview = [];
   const profiles = listProfiles(platform);
-  const targetModels = modelList ?? profiles.map((p10) => p10.model);
+  const targetModels = modelList ?? profiles.map((p9) => p9.model);
   try {
     if (targetModels.length > 0) {
       const db = await openDatabase(platform);
@@ -9636,14 +9789,14 @@ async function syncRemoveCommand(platform, options) {
   } catch {
     for (const model of targetModels) preview.push({ model, records: 0 });
   }
-  const totalRecords = preview.reduce((sum, p10) => sum + p10.records, 0);
+  const totalRecords = preview.reduce((sum, p9) => sum + p9.records, 0);
   const dbSize = getDatabaseSize(platform);
   if (options.dryRun) {
     if (isAgentMode()) {
       json({ dryRun: true, platform, models: preview, totalRecords, dbSize });
     } else {
       note(
-        preview.map((p10) => `  ${p10.model.padEnd(30)} ${String(p10.records).padStart(8)} records`).join("\n") + `
+        preview.map((p9) => `  ${p9.model.padEnd(30)} ${String(p9.records).padStart(8)} records`).join("\n") + `
 
   Total: ${totalRecords} records across ${preview.length} model(s), ${dbSize} on disk`,
         `Would remove from ${platform}`
@@ -9653,10 +9806,10 @@ async function syncRemoveCommand(platform, options) {
   }
   if (!options.yes && !isAgentMode()) {
     const target = modelList ? `${platform}/${modelList.join(", ")}` : `all synced data for ${platform}`;
-    const confirmed = await p7.confirm({
+    const confirmed = await p6.confirm({
       message: `Remove ${target}? (${totalRecords} records, ${dbSize} on disk)`
     });
-    if (p7.isCancel(confirmed) || !confirmed) {
+    if (p6.isCancel(confirmed) || !confirmed) {
       cancel("Cancelled.");
       return;
     }
@@ -9891,7 +10044,7 @@ function registerSyncSubcommands(sync) {
 }
 
 // src/commands/mem/init.ts
-import * as p8 from "@clack/prompts";
+import * as p7 from "@clack/prompts";
 async function memInitCommand(flags) {
   if (!readConfig()) {
     error("Run `one init` first to configure the base One CLI before `one mem init`.");
@@ -9900,11 +10053,11 @@ async function memInitCommand(flags) {
     if (isAgentMode()) {
       error("Memory is already configured. Pass --force to overwrite, or use `one mem config` to adjust.");
     }
-    const shouldOverwrite = flags.yes ?? await p8.confirm({
+    const shouldOverwrite = flags.yes ?? await p7.confirm({
       message: "Memory is already configured. Overwrite the current config?",
       initialValue: false
     });
-    if (p8.isCancel(shouldOverwrite) || !shouldOverwrite) {
+    if (p7.isCancel(shouldOverwrite) || !shouldOverwrite) {
       outro("Aborted. Run `one mem config` to adjust specific fields.");
       return;
     }
@@ -9954,7 +10107,7 @@ Run \`one mem doctor\` for a detailed report.`,
 async function interactiveInit(flags) {
   intro("one mem init");
   const plugins = listBackendPlugins();
-  const backend = flags.backend ?? await p8.select({
+  const backend = flags.backend ?? await p7.select({
     message: "Where should memory live?",
     options: plugins.map((plug) => ({
       value: plug.name,
@@ -9963,26 +10116,26 @@ async function interactiveInit(flags) {
     })),
     initialValue: "embedded-postgres"
   });
-  if (p8.isCancel(backend)) error("Cancelled.");
+  if (p7.isCancel(backend)) error("Cancelled.");
   const perBackend = {};
   if (backend === "embedded-postgres") {
-    const dataDir = flags.dbPath ?? await p8.text({
+    const dataDir = flags.dbPath ?? await p7.text({
       message: "Postgres data directory (leave blank for default)",
       placeholder: "~/.one/pg",
       initialValue: ""
     });
-    if (p8.isCancel(dataDir)) error("Cancelled.");
+    if (p7.isCancel(dataDir)) error("Cancelled.");
     if (dataDir) perBackend["embedded-postgres"] = { dataDir };
   } else if (backend === "postgres") {
-    const connectionString = flags.connectionString ?? await p8.text({
+    const connectionString = flags.connectionString ?? await p7.text({
       message: "Postgres connection string",
       placeholder: "postgres://user:pass@host:5432/dbname",
       validate: (v) => v ? void 0 : "Connection string is required"
     });
-    if (p8.isCancel(connectionString)) error("Cancelled.");
+    if (p7.isCancel(connectionString)) error("Cancelled.");
     perBackend.postgres = { connectionString };
   }
-  const provider = flags.embedding ?? await p8.select({
+  const provider = flags.embedding ?? await p7.select({
     message: "Enable embeddings (semantic search)?",
     options: [
       { value: "openai", label: "Yes, via OpenAI", hint: "requires an API key" },
@@ -9990,7 +10143,7 @@ async function interactiveInit(flags) {
     ],
     initialValue: "none"
   });
-  if (p8.isCancel(provider)) error("Cancelled.");
+  if (p7.isCancel(provider)) error("Cancelled.");
   let apiKey;
   let embedOnAdd = DEFAULT_MEMORY_CONFIG.defaults.embedOnAdd;
   let embedOnSync = DEFAULT_MEMORY_CONFIG.defaults.embedOnSync;
@@ -9999,25 +10152,25 @@ async function interactiveInit(flags) {
     if (flags.openaiKey) {
       apiKey = flags.openaiKey;
     } else {
-      const entered = await p8.password({
+      const entered = await p7.password({
         message: "OpenAI API key",
         mask: "\u2022",
         validate: (v) => v || envKey ? void 0 : "Required (or set OPENAI_API_KEY)"
       });
-      if (p8.isCancel(entered)) error("Cancelled.");
+      if (p7.isCancel(entered)) error("Cancelled.");
       apiKey = entered || envKey;
     }
-    const embedAdd = flags.embedOnAdd ?? await p8.confirm({
+    const embedAdd = flags.embedOnAdd ?? await p7.confirm({
       message: "Embed user memories (mem add) by default?",
       initialValue: true
     });
-    if (p8.isCancel(embedAdd)) error("Cancelled.");
+    if (p7.isCancel(embedAdd)) error("Cancelled.");
     embedOnAdd = embedAdd;
-    const embedSync = flags.embedOnSync ?? await p8.confirm({
+    const embedSync = flags.embedOnSync ?? await p7.confirm({
       message: "Embed synced records by default? (overridable per profile)",
       initialValue: false
     });
-    if (p8.isCancel(embedSync)) error("Cancelled.");
+    if (p7.isCancel(embedSync)) error("Cancelled.");
     embedOnSync = embedSync;
   }
   return {
@@ -10238,9 +10391,9 @@ function redactSecrets(cfg) {
 function getPath(obj, path14) {
   const parts = path14.split(".");
   let cur = obj;
-  for (const part of parts) {
+  for (const part2 of parts) {
     if (cur == null || typeof cur !== "object") return void 0;
-    cur = cur[part];
+    cur = cur[part2];
   }
   return cur;
 }
@@ -10248,9 +10401,9 @@ function setPath(obj, path14, value) {
   const parts = path14.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    if (cur[part] == null || typeof cur[part] !== "object") cur[part] = {};
-    cur = cur[part];
+    const part2 = parts[i];
+    if (cur[part2] == null || typeof cur[part2] !== "object") cur[part2] = {};
+    cur = cur[part2];
   }
   cur[parts[parts.length - 1]] = value;
   return obj;
@@ -10259,9 +10412,9 @@ function unsetPath(obj, path14) {
   const parts = path14.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
-    const part = parts[i];
-    if (cur[part] == null || typeof cur[part] !== "object") return obj;
-    cur = cur[part];
+    const part2 = parts[i];
+    if (cur[part2] == null || typeof cur[part2] !== "object") return obj;
+    cur = cur[part2];
   }
   delete cur[parts[parts.length - 1]];
   return obj;
@@ -10375,10 +10528,10 @@ async function memListCommand(type, flags) {
   const backend = await getBackend();
   const limit = flags.limit ? parsePositiveInt(flags.limit, 100, "limit") : 100;
   const offset = flags.offset ? parsePositiveInt(flags.offset, 0, "offset") : 0;
-  const status = flags.status ?? "active";
+  const status2 = flags.status ?? "active";
   const [records, total] = await Promise.all([
-    backend.list(type, { limit, offset, status }),
-    backend.count(type, { status })
+    backend.list(type, { limit, offset, status: status2 }),
+    backend.count(type, { status: status2 })
   ]);
   if (isAgentMode()) {
     json({ items: records, returned: records.length, total, limit, offset });
@@ -10581,7 +10734,7 @@ async function memDoctorCommand() {
     return emit(checks, { vectorSearchAvailable: true });
   }
   checks.push({ name: "memory config exists", ok: true, detail: `backend=${cfg.backend}` });
-  const available = listBackendPlugins().map((p10) => p10.name);
+  const available = listBackendPlugins().map((p9) => p9.name);
   if (!available.includes(cfg.backend)) {
     checks.push({
       name: `backend plugin "${cfg.backend}" resolves`,
@@ -10712,10 +10865,10 @@ async function memExportCommand(outfile) {
   const pageSize = 500;
   let written = 0;
   for (const type of all) {
-    for (const status of ["active", "archived"]) {
+    for (const status2 of ["active", "archived"]) {
       let offset = 0;
       while (true) {
-        const page = await backend.list(type, { limit: pageSize, offset, status });
+        const page = await backend.list(type, { limit: pageSize, offset, status: status2 });
         for (const r of page) {
           await writeLine(stream, JSON.stringify(r) + "\n");
           written++;
@@ -10925,12 +11078,12 @@ async function memReindexSearchableCommand(flags) {
 // src/commands/mem.ts
 function memStatusCommand() {
   const cfg = getMemoryConfig();
-  const plugins = listBackendPlugins().map((p10) => ({
-    name: p10.name,
-    description: p10.description,
-    version: p10.version,
-    schemaVersion: p10.schemaVersion,
-    capabilities: p10.capabilities
+  const plugins = listBackendPlugins().map((p9) => ({
+    name: p9.name,
+    description: p9.description,
+    version: p9.version,
+    schemaVersion: p9.schemaVersion,
+    capabilities: p9.capabilities
   }));
   const upgrade = semanticSearchUpgradeHint();
   const payload = {
@@ -11052,9 +11205,6 @@ async function cacheUpdateAllCommand() {
     error("Not configured. Run `one init` first.");
   }
   const api = new OneApi(apiKey, getApiBase());
-  const ac = getAccessControlFromAllSources();
-  const permissions = ac.permissions || "admin";
-  const actionIds = ac.actionIds || ["*"];
   const entries = listCacheEntries();
   if (entries.length === 0) {
     if (isAgentMode()) {
@@ -11071,44 +11221,9 @@ async function cacheUpdateAllCommand() {
   const errors = [];
   for (const e of entries) {
     try {
-      if (e.type === "knowledge") {
-        const result = await api.getActionDetailsWithMeta(e.entry.key);
-        const newEntry = makeCacheEntry(e.entry.key, result.data, result.etag);
-        writeCache(e.filePath, newEntry);
-        updated++;
-      } else {
-        const data = e.entry.data;
-        if (data?.platform && data?.query) {
-          const searchType = data.searchType ?? "knowledge";
-          const result = await api.searchActionsWithMeta(
-            data.platform,
-            data.query,
-            searchType,
-            e.entry.etag ?? void 0
-          );
-          if (result.status === 304) {
-            writeCache(e.filePath, { ...e.entry, cachedAt: (/* @__PURE__ */ new Date()).toISOString() });
-          } else {
-            let actions2 = result.data;
-            actions2 = filterByPermissions(actions2, permissions);
-            actions2 = actions2.filter((a) => isActionAllowed(a.systemId, actionIds));
-            const cleaned = actions2.map((a) => ({
-              actionId: a.systemId,
-              title: a.title,
-              method: a.method,
-              path: a.path
-            }));
-            writeCache(e.filePath, makeCacheEntry(
-              e.entry.key,
-              { actions: cleaned, platform: data.platform, query: data.query, searchType },
-              result.etag
-            ));
-          }
-        } else {
-          writeCache(e.filePath, { ...e.entry, cachedAt: (/* @__PURE__ */ new Date()).toISOString() });
-        }
-        updated++;
-      }
+      const result = await api.getActionDetailsWithMeta(e.entry.key);
+      writeCache(e.filePath, makeCacheEntry(e.entry.key, result.data, result.etag));
+      updated++;
     } catch (err) {
       failed++;
       errors.push({
@@ -11174,14 +11289,14 @@ Before using any feature, read its guide section first: \`one guide actions\`, \
 ## Features
 
 ### 1. Actions \u2014 Execute API calls on 750+ platforms
-Search for actions, read their docs, and execute them. This is the core workflow.
+Find the actions a task needs with their docs, in one call, then execute them. This is the core workflow.
 
 **Quick start:**
 \`\`\`bash
 one --agent connection list                                    # See connected platforms + your access on each
 one --agent connection delete <connection-key>                 # Remove a connection
-one --agent actions search <platform> "<query>" -t execute     # Find an action
-one --agent actions knowledge <platform> <actionId>            # Read docs (REQUIRED)
+one --agent actions find <platform> "<intent>" [<platform> "<intent>" ...] --task "<the job, in general terms>"  # Find every action, with its docs (READ them)
+one --agent actions load <actionId> --section "<name>"          # More of a doc: a section it left out, --full, --toc
 one --agent actions execute <platform> <actionId> <key> -d '{}'  # Execute it
 \`\`\`
 
@@ -11244,7 +11359,7 @@ one --agent relay deliveries --endpoint-id <id>                 # Check delivery
 - \`passthrough\` actions map webhook fields to another platform's API using Handlebars: \`{{payload.data.object.email}}\`
 - Template context: \`{{relayEventId}}\`, \`{{platform}}\`, \`{{eventType}}\`, \`{{payload}}\`, \`{{timestamp}}\`, \`{{connectionId}}\`
 - \`--create-webhook\` auto-registers the webhook URL with the source platform
-- Use \`actions knowledge\` to learn both the incoming payload shape AND the destination API shape before building templates
+- Use \`actions find\` (and \`actions load\` for more) to learn both the incoming payload shape AND the destination API shape before building templates
 
 ### 4. Memory + Sync \u2014 Unified store with hybrid FTS + semantic search
 One ships a local memory store (a real Postgres process bootstrapped on demand via the bundled \`embedded-postgres\` plugin, with a \`postgres\` plugin for remote/self-hosted) that backs both user-authored notes (\`one mem add\`) and synced platform data (\`one sync run\`). Auto-initializes on first use \u2014 no separate install step. Run \`one guide memory\` and \`one guide sync\` for the full references.
@@ -11253,7 +11368,7 @@ One ships a local memory store (a real Postgres process bootstrapped on demand v
 
 Request specific sections:
 - \`one guide overview\` \u2014 This section
-- \`one guide actions\` \u2014 Actions reference (search, knowledge, execute)
+- \`one guide actions\` \u2014 Actions reference (find, load, execute)
 - \`one guide flows\` \u2014 Workflow engine reference (step types, selectors, examples)
 - \`one guide relay\` \u2014 Webhook relay reference (templates, passthrough actions)
 - \`one guide cache\` \u2014 Cache management (TTL, flags, commands)
@@ -11264,7 +11379,7 @@ Request specific sections:
 
 - **Always use \`--agent\` flag** for structured JSON output
 - Platform names are **lowercase**; multi-word names use dashes (e.g., \`hubspot\`, \`google-calendar\`)
-- Always use the **exact action ID** from search results \u2014 don't guess
+- Always use the **exact action ID** from a find answer \u2014 don't guess
 - Always read **knowledge** before executing any action
 - Connection keys come from \`one connection list\` \u2014 don't hardcode them
 - \`connection list\` also reports an \`access\` field per connection (\`full\` / \`methods\` / \`actions\`) \u2014 read it before planning so you don't propose an action the access config will reject
@@ -11272,9 +11387,9 @@ Request specific sections:
 `;
 var GUIDE_ACTIONS = `# One Actions \u2014 Reference
 
-## Workflow: search \u2192 knowledge \u2192 execute
+## Workflow: find \u2192 execute
 
-Always follow this sequence. Never skip the knowledge step.
+Always follow this sequence. Never execute without reading the action's documentation, which \`actions find\` returns.
 
 ### 1. List Connections
 
@@ -11288,9 +11403,9 @@ Returns platforms, status, connection keys, tags, and an \`access\` field per co
 |----------|---------|
 | \`{"policy": "full"}\` | Every action on the connection |
 | \`{"policy": "methods", "methods": ["GET"]}\` | Only actions with these HTTP methods will execute |
-| \`{"policy": "actions", "actions": [{"actionId", "title", "method"}]}\` | Only these exact actions \u2014 use them directly, skip \`actions search\` |
+| \`{"policy": "actions", "actions": [{"actionId", "title", "method"}]}\` | Only these exact actions \u2014 use them directly: \`actions load <actionId>\` reads their docs, no find needed |
 
-Also present when relevant: \`knowledgeOnly: true\` (execution disabled \u2014 read knowledge and write code instead), \`unresolvedActionIds\` (allowlisted ids that could not be looked up), and \`accessHint\` (a one-line summary of the restriction).
+Also present when relevant: \`knowledgeOnly: true\` (execution disabled \u2014 read the docs and write code instead), \`unresolvedActionIds\` (allowlisted ids that could not be looked up), and \`accessHint\` (a one-line summary of the restriction).
 
 Read \`access\` before planning \u2014 it prevents proposing an action the config will reject. Change it with \`one config\`.
 
@@ -11302,60 +11417,72 @@ one --agent connection delete <connection-key>
 
 Removes a connection by its key. In agent mode, returns \`{"deleted": true, "platform": "...", "key": "..."}\`. The connection key comes from \`one connection list\`.
 
-### 2. Search Actions
+### 2. Find Actions
 
 \`\`\`bash
-one --agent actions search <platform> "<query>" -t execute
+one --agent actions find <platform> "<intent>" [<platform> "<intent>" ...] --task "<the job, in general terms>"
 \`\`\`
 
-- Use \`-t execute\` when the user wants to perform an action
-- Use \`-t knowledge\` (default) for documentation/code generation
-- Returns up to 5 matching actions with IDs, methods, and paths
+One call for the whole task: one platform and intent pair per operation, on any platforms (up to 10). One's decision model picks the action for each and returns it **with its documentation** \u2014 required fields, validation rules, request structure. **Read it before execute.**
 
-### 3. Get Knowledge
-
-\`\`\`bash
-one --agent actions knowledge <platform> <actionId>
-\`\`\`
+- **\`intent\` names the operation alone**, in a few words: \`"send a message to a channel"\`, not \`"post 'deploy done' in #eng"\`. IDs, names, and message text in the intent make the search miss.
+- **\`--task\`** (optional) is the whole job in one line, **in general terms**: what it does, without names, addresses, IDs, or message text. It helps choose between similar actions.
+- **\`-t knowledge\`** searches the catalog for writing code and building flows and relays, which includes the platform's own (passthrough) endpoints; the default, \`-t execute\`, is the catalog for running actions now. Knowledge-only mode always uses \`knowledge\`.
+- **\`--ai-model\`** (optional) names the model running the CLI (e.g. \`claude-sonnet-5\`); it will be used to tune documentation per model.
+- **\`--no-knowledge\`** (optional) lists the chosen actions without their documentation, when only the actionIds are needed. Load the documentation with \`actions load\` before executing.
 
-Returns the API docs: required fields, validation rules, request structure. **REQUIRED before execute.** The output includes a CLI PARAMETER MAPPING section showing which flags to use.
-
-**In \`--agent\` mode this is a digest, not the whole document.** Large docs (most of their size is response shapes and optional-field tables) are trimmed to the sections needed to build a correct request: method/URL, headers, description, enforcement rules, required and optional parameters, sample request, gotchas, error handling. Everything else is listed in a table of contents so you can pull it on demand:
+In \`--agent\` mode:
 
 \`\`\`json
 {
-  "knowledge": "...digest markdown, ends with a notice naming the omitted sections...",
-  "method": "POST",
-  "title": "Create an Issue",
-  "truncated": true,
-  "sections": [
-    { "id": "response", "heading": "Response", "level": 2, "chars": 16483, "included": false },
-    { "id": "response-fields", "heading": "Response Fields", "level": 2, "chars": 3353, "included": false }
+  "answers": [
+    {
+      "platform": "gmail",
+      "intent": "send an email",
+      "status": "Chosen with confidence 0.99.",
+      "selector": "model",
+      "confidence": 0.99,
+      "selected": [
+        { "actionId": "conn_mod_def::...", "title": "Send Email", "method": "POST", "path": "/v1/gmail/send-email",
+          "knowledge": "...digest markdown, ends with the exact actions load command for what it left out...", "truncated": true }
+      ],
+      "alsoSelected": [],
+      "runnerUp": { "actionId": "...", "title": "...", "method": "...", "path": "...", "knowledge": "...", "truncated": false },
+      "alternatives": [ { "actionId": "...", "title": "...", "method": "...", "path": "..." } ]
+    }
   ],
-  "omitted": 2,
-  "omittedChars": 19836,
-  "more": { "section": "one --agent actions knowledge <platform> <actionId> --section <id>[,<id>...]", "full": "..." }
+  "guide": "Run an action with: one --agent actions execute <platform> <actionId> <connectionKey> ..."
 }
 \`\`\`
 
-- \`truncated: false\` means you have the whole document \u2014 small docs are never trimmed, and no \`sections\` list is sent.
-- \`sections\` lists only what was omitted. \`included\` is \`false\` or \`"partial"\` (an oversized essential section was cut; its text ends with a truncation marker). Included sections are simply the headings in the markdown.
-- Load more by heading, id, or alias \u2014 several at once, comma-separated or repeated:
+- **\`selected\`** \u2014 the action(s) to use, documented. More than one means the intent needs them together (look up, then update).
+- **\`alsoSelected\`** \u2014 also needed, listed rather than documented to keep the answer small: \`actions load\` them.
+- **\`runnerUp\`** \u2014 only when the model was unsure: a **substitute** for the pick. Use one or the other, **never both**.
+- **\`alternatives\`** \u2014 other candidates, undocumented.
+- **\`status\`** \u2014 why: a confidence, *no action fits* (rephrase the intent by outcome, or check the platform), *the decision model was unavailable* (top search result: check it fits), *not allowed by this CLI* (the next allowed candidate stood in), or *allow none of them* (your access settings block the operation \u2014 rephrasing won't help).
+- **\`guide\`** \u2014 how to execute, stated once for every action.
+- \`truncated: false\` means \`knowledge\` is the whole document; small docs are never trimmed.
 
-\`\`\`bash
-one --agent actions knowledge <platform> <actionId> --section "Response Fields"
-one --agent actions knowledge <platform> <actionId> --section response,optional
-one --agent actions knowledge <platform> <actionId> --full
-\`\`\`
+A large doc is a **digest**: the sections needed to build a correct request (method/URL, headers, description, enforcement rules, required and optional parameters, sample request, gotchas, error handling), then a notice naming what it left out with the exact command to load it.
 
-Aliases: \`response\`, \`fields\`, \`optional\`, \`required\`, \`examples\`, \`errors\`, \`success\`, \`body\`, \`query\`, \`path\`, \`notes\`, \`behavior\`, \`gotchas\`. A parent section brings its subsections. Section requests are served from the local cache \u2014 no network call. An unknown name returns an error that lists every available section, so retry with one of those ids.
+In knowledge-only mode (\`one config\`), each pick comes back **whole**, with how to call it from code through the One Passthrough API, and \`guide\` is the Integration Code Guide.
 
-A \`--section\` response carries \`requested\`, \`resolved\` (the ids each name matched \u2014 alias and prefix matches are visible here), and \`truncated: false\` (the requested sections are whole). It does not repeat the table of contents. On scraped mega-docs with hundreds of headings the digest's \`sections\` list is collapsed to the top levels (\`sectionsCollapsed: true\`, each entry's \`children\` counts the hidden ones); \`--toc\` returns the complete list without the document:
+Find reads documentation through the local cache, so a later \`actions execute\` of the same action makes a single API call.
+
+### 3. Load More of a Document
 
 \`\`\`bash
-one --agent actions knowledge <platform> <actionId> --toc
+one --agent actions load <actionId> --section "Response Fields"
+one --agent actions load <actionId> --section response,optional
+one --agent actions load <actionId> --full
+one --agent actions load <actionId> --toc
+one --agent actions load <actionId>                 # the digest: how to read an alternative
 \`\`\`
 
+Up to 10 action ids at once; the flags apply to each. Aliases: \`response\`, \`fields\`, \`optional\`, \`required\`, \`examples\`, \`errors\`, \`success\`, \`body\`, \`query\`, \`path\`, \`notes\`, \`behavior\`, \`gotchas\`. A parent section brings its subsections. Loads are served from the local cache once a doc is cached. An unknown section name returns the list of available sections, so retry with one of those ids. \`--toc\` lists every section of the document (id, heading, size) without the text.
+
+In \`--agent\` mode: \`{ "loaded": [ { "actionId", "title", "method", "path", "knowledge", "truncated" } | { "actionId", "error" } ], "guide": "..." }\`. An action your access settings refuse reads the same as one that doesn't exist.
+
 ### 4. Execute
 
 \`\`\`bash
@@ -11375,7 +11502,7 @@ one --agent actions execute <platform> <actionId> <connectionKey> [options]
 - \`--output <path>\` \u2014 Save response to a file (for binary downloads like PDFs, images, documents). Text responses (text/plain, HTML, CSV, XML) render inline automatically \u2014 \`--output\` is only needed for genuinely binary payloads.
 - \`--no-cache\` \u2014 Bypass the cached action details and re-fetch them; the fresh details still refresh the cache (execution itself is never cached)
 
-Execute reuses the action details cached by \`actions knowledge\` (method, path, schema), so in the standard search \u2192 knowledge \u2192 execute flow it makes a single API call \u2014 the action being executed. The live response is never cached. In \`--agent\` mode the response includes \`"_preflight": {"cache": "hit"|"miss"}\` showing whether the lookup was served from disk.
+Execute reuses the action details cached by \`actions find\` and \`actions load\` (method, path, schema), so in the standard find \u2192 execute flow it makes a single API call \u2014 the action being executed. The live response is never cached. In \`--agent\` mode the response includes \`"_preflight": {"cache": "hit"|"miss"}\` showing whether the lookup was served from disk.
 
 **Do NOT** pass path or query parameters in \`-d\`. Use the correct flags.
 
@@ -11414,7 +11541,7 @@ All errors return JSON: \`{"error": "message"}\`. Check the \`error\` key.
 
 - Platform names are **lowercase**; multi-word names use dashes (e.g., \`hubspot\`, \`ship-station\`)
 - JSON flags use single quotes around the JSON to avoid shell escaping
-- If search returns no results, try broader queries
+- If find says no action fits, rephrase the intent by outcome (\`"list invoices"\`, not an endpoint name) or check the platform name
 - Access control settings from \`one config\` may restrict execution
 `;
 var GUIDE_FLOWS = generateFlowGuide();
@@ -11529,9 +11656,9 @@ var GUIDE_CACHE = `# One Cache \u2014 Reference
 
 ## Overview
 
-The One CLI caches \`actions knowledge\` and \`actions search\` responses locally so repeated calls serve instantly from disk instead of hitting the API. The knowledge cache stores the action's full details (docs, method, path, schema), so \`actions execute\` reuses it for its preflight lookup \u2014 in the standard search \u2192 knowledge \u2192 execute flow, execute makes exactly one API call: the action itself.
+The One CLI caches each action's details (docs, method, path, schema) locally, so repeated calls serve instantly from disk instead of hitting the API. \`actions find\` and \`actions load\` read documentation through this cache, and \`actions execute\` reuses it for its preflight lookup \u2014 in the standard find \u2192 execute flow, execute makes exactly one API call: the action itself. Find's picks themselves are not cached: they come from One's decision model on every call.
 
-Cache location: \`~/.one/cache/knowledge/\` and \`~/.one/cache/search/\`
+Cache location: \`~/.one/cache/knowledge/\`
 
 ## How It Works
 
@@ -11539,7 +11666,7 @@ Cache location: \`~/.one/cache/knowledge/\` and \`~/.one/cache/search/\`
 - **Subsequent calls (within TTL)**: serves from cache instantly, no API call
 - **After TTL expires**: makes a conditional request (ETag). If content unchanged, refreshes the cache timestamp. If changed, writes fresh data.
 - **Network failure with stale cache**: serves the stale cache with a warning \u2014 never fails hard when a cache exists
-- **Shared preflight**: \`actions execute\`, flow action steps, and \`sync\` all read action details (method, path, validation schema) from the same cache and warm it on a miss \u2014 so a knowledge call, a flow run, and a later execute of the same action all reuse one cached lookup
+- **Shared preflight**: \`actions find\`, \`actions load\`, \`actions execute\`, flow action steps, and \`sync\` all read action details (method, path, validation schema) from the same cache and warm it on a miss \u2014 so a find, a flow run, and a later execute of the same action all reuse one cached lookup
 
 Default TTL: 3600 seconds (1 hour). Configure via \`ONE_CACHE_TTL\` env var or \`cacheTtl\` in \`~/.one/config.json\`.
 
@@ -11547,44 +11674,27 @@ Default TTL: 3600 seconds (1 hour). Configure via \`ONE_CACHE_TTL\` env var or \
 
 | Cached | Not Cached |
 |--------|-----------|
-| \`actions knowledge\` (API docs, change infrequently) | \`actions execute\` responses (live data, always fresh) |
-| \`actions search\` results | \`connection list\` (changes with add/remove) |
+| Action docs read by \`actions find\` / \`actions load\` (change infrequently) | \`actions execute\` responses (live data, always fresh) |
+| | \`actions find\` picks (the decision model answers every call) |
+| | \`connection list\` (changes with add/remove) |
 | Action details used by execute / flow / sync preflight (method, path, schema) | |
 
-## Agent Mode \`_cache\` Metadata
+## Cache Status
 
-In \`--agent\` mode, knowledge and search responses include a \`_cache\` field:
-
-\`\`\`json
-{
-  "knowledge": "...",
-  "method": "POST",
-  "truncated": true,
-  "sections": [ ... ],
-  "_cache": {
-    "hit": true,
-    "age": 1423,
-    "fresh": true
-  }
-}
-\`\`\`
-
-Use this to programmatically decide whether to force-refresh.
+\`actions load --cache-status\` prints, for each action id, whether its details are cached, when, their age and TTL, whether they have expired, and their ETag, without fetching anything.
 
 ## Cache Flags
 
 \`\`\`bash
 # Skip cache, fetch fresh (result still gets cached for next time)
-one --agent actions knowledge <platform> <actionId> --no-cache
+one --agent actions load <actionId> --no-cache
+one --agent actions find <platform> "<intent>" --no-cache
 
 # Check cache status without fetching
-one --agent actions knowledge <platform> <actionId> --cache-status
+one --agent actions load <actionId> --cache-status
 
 # Sections and --full are served from the cache once the doc is cached
-one --agent actions knowledge <platform> <actionId> --section "Response Fields"
-
-# Same for search
-one --agent actions search <platform> "<query>" --no-cache
+one --agent actions load <actionId> --section "Response Fields"
 
 # Same for execute's action-details preflight (the action itself always runs live)
 one --agent actions execute <platform> <actionId> <key> --no-cache
@@ -11597,7 +11707,7 @@ In \`--agent\` mode, execute responses include \`"_preflight": {"cache": "hit"|"
 \`\`\`bash
 one cache list                    # List all cached entries with age and status
 one cache list --expired          # List only expired entries
-one cache clear                   # Delete all cached knowledge and search data
+one cache clear                   # Delete all cached action documentation
 one cache clear <actionId>        # Delete one specific entry
 one cache update-all              # Re-fetch fresh data for all cached entries
 \`\`\`
@@ -11860,7 +11970,7 @@ Why the block:
   enrichment locally \u2014 server-side fan-out on top of that creates 5xx, not value
 
 How to build a profile:
-1. \`one actions search <platform> "<model>"\` surfaces passthrough actions.
+1. \`one actions find <platform> "list <model>" -t knowledge\` surfaces passthrough actions (the pick and its alternatives).
    \`sync init\`'s auto-infer also drops customs before offering choices.
 2. Prefer GET passthrough endpoints (e.g. /gmail/v1/users/{userId}/threads)
    over POST custom endpoints (e.g. /gmail/get-threads).
@@ -12292,7 +12402,7 @@ var TOPICS = [
   { topic: "actions", description: "Search, read docs, and execute platform actions" },
   { topic: "flows", description: "Build and execute multi-step workflows" },
   { topic: "relay", description: "Receive webhooks and forward to other platforms" },
-  { topic: "cache", description: "Local caching for knowledge and search responses" },
+  { topic: "cache", description: "Local caching for action documentation" },
   { topic: "memory", description: "Unified memory store: notes, decisions, synced rows, semantic search" },
   { topic: "sync", description: "Sync platform data into memory for instant offline queries" },
   { topic: "all", description: "Complete guide (all topics combined)" }
@@ -12384,7 +12494,7 @@ function pairKey(a, b) {
 }
 function getWorkflowExamples(connectedPlatforms) {
   const results = [];
-  const platforms = connectedPlatforms.map((p10) => p10.toLowerCase());
+  const platforms = connectedPlatforms.map((p9) => p9.toLowerCase());
   for (let i = 0; i < platforms.length; i++) {
     for (let j = i + 1; j < platforms.length; j++) {
       const key = pairKey(platforms[i], platforms[j]);
@@ -12501,17 +12611,17 @@ common mistakes to avoid. Never guess \u2014 read the skill, then act.
 
 ### Quick reference:
 - \`one --agent list\` \u2014 See connected platforms and connection keys
-- \`one --agent actions search <platform> "<query>"\` \u2014 Find actions
-- \`one --agent actions knowledge <platform> <actionId>\` \u2014 Read docs (REQUIRED before execute; a digest \u2014 add \`--section <name>\` or \`--full\` for more)
+- \`one --agent actions find <platform> "<intent>" [<platform> "<intent>" ...]\` \u2014 Find every action a task needs, with its docs (READ them before execute)
+- \`one --agent actions load <actionId> --section <name>\` \u2014 More of a doc (a digest names the exact command), or \`--full\`
 - \`one --agent actions execute <platform> <actionId> <connectionKey>\` \u2014 Execute action
 - \`one --agent flow create\` \u2014 Build multi-step workflows
 - \`one --agent relay create\` \u2014 Set up webhook relay (receive events, forward to other platforms)
 - \`one --agent guide\` \u2014 Full documentation
 - \`one add <platform>\` \u2014 Connect a new platform (interactive, no --agent)
 
-### Workflow: search -> knowledge -> execute
-Always read the knowledge before executing. It tells you required parameters,
-validation rules, and platform-specific details.
+### Workflow: find -> execute
+Always read the documentation find returns before executing. It tells you
+required parameters, validation rules, and platform-specific details.
 
 ### Webhook Relay
 Use \`one relay\` to receive webhooks from platforms (Stripe, GitHub, etc.)
@@ -12525,8 +12635,7 @@ Handlebars templates. No middleware needed.
 Every command supports \`--agent\` which gives you clean, structured JSON
 output instead of human-formatted text. Always use it:
   one --agent list
-  one --agent actions search gmail "send email"
-  one --agent actions knowledge gmail <actionId>
+  one --agent actions find gmail "send an email" --task "email a report to a contact"
   one --agent actions execute gmail <actionId> <connectionKey> -d '{...}'
   one --agent platforms
   one --agent guide
@@ -12534,8 +12643,8 @@ output instead of human-formatted text. Always use it:
 The \`--agent\` flag goes right after \`one\`, before the subcommand.
 
 ### Discovery Workflow (follow this every time):
-1. \`one --agent actions search <platform> "<query>"\` \u2014 Find the right action
-2. \`one --agent actions knowledge <platform> <actionId>\` \u2014 Read the docs (ALWAYS before execute)
+1. \`one --agent actions find <platform> "<intent>" [<platform> "<intent>" ...] --task "<the job>"\` \u2014 Find every action the task needs, with its docs; each intent names the operation alone, without its data
+2. Read each action's docs (ALWAYS before execute); \`one --agent actions load <actionId> --section <name>\` for a section a digest left out
 3. \`one --agent actions execute <platform> <actionId> <connectionKey>\` \u2014 Execute it
 
 ### Multi-Step Workflows:
@@ -12616,8 +12725,8 @@ You have ${connections.length} platform(s) connected:
   const tableHeader = "  Platform                Status        Connection Key";
   const tableRows = connections.map((c) => {
     const platform = c.platform.padEnd(22);
-    const status = c.state.padEnd(14);
-    return `  ${platform}${status}${c.key}`;
+    const status2 = c.state.padEnd(14);
+    return `  ${platform}${status2}${c.key}`;
   });
   return header + "\n" + tableHeader + "\n" + tableRows.join("\n");
 }
@@ -12628,13 +12737,13 @@ function buildDemoActions(connections) {
   const connectedPlatforms = connections.map((c) => c.platform.toLowerCase());
   const popularPlatforms = ["gmail", "google-calendar", "slack", "shopify", "hubspot", "github"];
   const platformsToShow = [
-    ...connectedPlatforms.filter((p10) => PLATFORM_DEMO_ACTIONS[p10]),
-    ...popularPlatforms.filter((p10) => !connectedPlatforms.includes(p10))
+    ...connectedPlatforms.filter((p9) => PLATFORM_DEMO_ACTIONS[p9]),
+    ...popularPlatforms.filter((p9) => !connectedPlatforms.includes(p9))
   ];
   const seen = /* @__PURE__ */ new Set();
-  const unique = platformsToShow.filter((p10) => {
-    if (seen.has(p10)) return false;
-    seen.add(p10);
+  const unique = platformsToShow.filter((p9) => {
+    if (seen.has(p9)) return false;
+    seen.add(p9);
     return true;
   }).slice(0, 6);
   for (const platform of unique) {
@@ -12643,7 +12752,7 @@ function buildDemoActions(connections) {
     const displayName = platform.split("-").map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
     lines.push("");
     lines.push(`### ${displayName}`);
-    lines.push(`- ${demo.description}: \`one actions search ${platform} "${demo.query}"\``);
+    lines.push(`- ${demo.description}: \`one actions find ${platform} "${demo.query}"\``);
     lines.push(`- Then get knowledge and execute to show the user the results`);
   }
   lines.push("");
@@ -12667,7 +12776,7 @@ function buildWorkflowIdeas(connections) {
 
 // src/commands/logout.ts
 import fs13 from "fs";
-import * as p9 from "@clack/prompts";
+import * as p8 from "@clack/prompts";
 function formatWhoami(config2, apiKey, pc16) {
   const whoami = config2.whoami;
   const env = getEnvFromApiKey(apiKey);
@@ -12729,8 +12838,8 @@ async function logoutCommand() {
       infoLines.push(`${pc16.magenta("Global config:")}`);
       infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc16));
     }
-    p9.note(infoLines.join("\n"));
-    const choice = await p9.select({
+    p8.note(infoLines.join("\n"));
+    const choice = await p8.select({
       message: "What would you like to log out of?",
       options: [
         { value: "project", label: "This directory", hint: "local config only" },
@@ -12738,8 +12847,8 @@ async function logoutCommand() {
         { value: "both", label: "Both", hint: "remove all credentials" }
       ]
     });
-    if (p9.isCancel(choice)) {
-      p9.cancel("Logout cancelled.");
+    if (p8.isCancel(choice)) {
+      p8.cancel("Logout cancelled.");
       return;
     }
     targetScope = choice;
@@ -12747,18 +12856,18 @@ async function logoutCommand() {
     const infoLines = ["You are logged in.", ""];
     infoLines.push(`${pc16.dim("Stored in")} ${pc16.cyan("local config")}`);
     infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc16));
-    p9.note(infoLines.join("\n"));
+    p8.note(infoLines.join("\n"));
     targetScope = "project";
   } else if (hasGlobal) {
     const infoLines = ["You are logged in.", ""];
     infoLines.push(`${pc16.dim("Stored in")} ${pc16.magenta("global config")}`);
     infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc16));
-    p9.note(infoLines.join("\n"));
+    p8.note(infoLines.join("\n"));
     targetScope = "global";
   } else {
-    p9.log.warn("Credentials are set via environment variable or .onerc, not a config file.");
-    p9.log.info("Remove the ONE_SECRET variable from your environment or .onerc file.");
-    p9.outro("Nothing to remove.");
+    p8.log.warn("Credentials are set via environment variable or .onerc, not a config file.");
+    p8.log.info("Remove the ONE_SECRET variable from your environment or .onerc file.");
+    p8.outro("Nothing to remove.");
     return;
   }
   const scopeLabels = {
@@ -12766,11 +12875,11 @@ async function logoutCommand() {
     global: "global",
     both: "all"
   };
-  const confirm7 = await p9.confirm({
+  const confirm7 = await p8.confirm({
     message: `Remove ${scopeLabels[targetScope]} credentials?`
   });
-  if (p9.isCancel(confirm7) || !confirm7) {
-    p9.cancel("Logout cancelled.");
+  if (p8.isCancel(confirm7) || !confirm7) {
+    p8.cancel("Logout cancelled.");
     return;
   }
   if (targetScope === "project" || targetScope === "both") {
@@ -12781,9 +12890,9 @@ async function logoutCommand() {
     const globalPath = getGlobalConfigPath();
     if (fs13.existsSync(globalPath)) fs13.unlinkSync(globalPath);
   }
-  p9.log.success("Credentials cleared.");
-  p9.log.info("Your API key is still active. Manage keys at app.withone.ai/settings");
-  p9.outro("Logged out.");
+  p8.log.success("Credentials cleared.");
+  p8.log.info("Your API key is still active. Manage keys at app.withone.ai/settings");
+  p8.outro("Logged out.");
 }
 
 // src/cli.ts
@@ -12804,9 +12913,9 @@ program.name("one").option("--agent", "Machine-readable JSON output (no colors,
 
   Workflow (use these in order):
     1. one list                           List connected platforms, keys, and your access on each
-    2. one actions search <platform> <q>  Search for actions using natural language
-    3. one actions knowledge <plat> <id>  Get docs for an action (ALWAYS do this before execute; --section/--full for more)
-    4. one actions execute <p> <id> <key> Execute the action
+    2. one actions find <p> <intent> ...  Find the action for every operation a task needs, with its docs (ALWAYS read them before execute)
+    3. one actions execute <p> <id> <key> Execute the action
+       one actions load <id> --section <s> More of an action's docs: a section a digest left out, --full, or --toc
 
   Guide:
     one guide [topic]                     Full CLI guide (topics: overview, actions, workflows, memory, sync, all)
@@ -12853,11 +12962,9 @@ program.name("one").option("--agent", "Machine-readable JSON output (no colors,
     $ one list
     # Find: gmail  operational  live::gmail::default::abc123
 
-    $ one actions search gmail "send email" -t execute
-    # Find: POST  Send Email  conn_mod_def::xxx::yyy
-
-    $ one actions knowledge gmail conn_mod_def::xxx::yyy
-    # Read the docs: required fields are to, subject, body, connectionKey
+    $ one actions find gmail "send an email" --task "email a report to a contact"
+    # Send Email \xB7 POST /v1/gmail/send-email \xB7 actionId: conn_mod_def::xxx::yyy
+    # ...its docs: required fields are to, subject, body, connectionKey
 
     $ one actions execute gmail conn_mod_def::xxx::yyy live::gmail::default::abc123 \\
         -d '{"to":"j@example.com","subject":"Hello","body":"Hi!","connectionKey":"live::gmail::default::abc123"}'
@@ -12964,22 +13071,22 @@ configSkills.command("sync").description("Re-copy packaged skill files over the
   console.log(`\u2717 Sync failed${result.error ? ": " + result.error : ""}`);
 });
 configSkills.command("status").description("Show installed skill version and whether it matches the current CLI").action(async () => {
-  const status = getSkillStatus();
+  const status2 = getSkillStatus();
   if (isAgentMode()) {
-    json({ command: "config skills status", ...status });
+    json({ command: "config skills status", ...status2 });
     return;
   }
-  if (!status.installed) {
+  if (!status2.installed) {
     console.log("Skill is not installed. Run 'one init' to install it.");
-    console.log(`Canonical path (empty): ${status.canonicalPath}`);
+    console.log(`Canonical path (empty): ${status2.canonicalPath}`);
     return;
   }
-  const marker = status.installedVersion ?? "(no marker \u2014 pre-sync install)";
-  const state = status.upToDate ? "\u2713 up to date" : "\u26A0 stale \u2014 will sync on next command";
+  const marker = status2.installedVersion ?? "(no marker \u2014 pre-sync install)";
+  const state = status2.upToDate ? "\u2713 up to date" : "\u26A0 stale \u2014 will sync on next command";
   console.log(`Skill: ${state}`);
   console.log(`  installed: ${marker}`);
-  console.log(`  current:   ${status.currentVersion}`);
-  console.log(`  path:      ${status.canonicalPath}`);
+  console.log(`  current:   ${status2.currentVersion}`);
+  console.log(`  path:      ${status2.canonicalPath}`);
 });
 config.command("reset").description("Remove the project config for the current directory (falls back to global)").option("--global", "Remove the global config instead").action(async (opts) => {
   const resolved = resolveConfig();
@@ -12994,12 +13101,12 @@ config.command("reset").description("Remove the project config for the current d
       return;
     }
     if (!isAgentMode()) {
-      const p10 = await import("@clack/prompts");
-      const confirmed = await p10.confirm({
+      const p9 = await import("@clack/prompts");
+      const confirmed = await p9.confirm({
         message: "Delete the global config? This removes your API key for all projects without a project config.",
         initialValue: false
       });
-      if (p10.isCancel(confirmed) || !confirmed) {
+      if (p9.isCancel(confirmed) || !confirmed) {
         console.log("Cancelled.");
         return;
       }
@@ -13037,12 +13144,12 @@ config.command("reset").description("Remove the project config for the current d
     fallbackLabel = "no config";
   }
   if (!isAgentMode()) {
-    const p10 = await import("@clack/prompts");
-    const confirmed = await p10.confirm({
+    const p9 = await import("@clack/prompts");
+    const confirmed = await p9.confirm({
       message: `Delete project config for ${path13.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
       initialValue: false
     });
-    if (p10.isCancel(confirmed) || !confirmed) {
+    if (p9.isCancel(confirmed) || !confirmed) {
       console.log("Cancelled.");
       return;
     }
@@ -13071,12 +13178,12 @@ connection.command("delete <connection-key>").alias("rm").description("Delete a
 program.command("platforms").alias("p").description("List available platforms").option("-c, --category <category>", "Filter by category").option("--json", "Output as JSON").action(async (options) => {
   await platformsCommand(options);
 });
-var actions = program.command("actions").alias("a").description("Search, explore, and execute platform actions (workflow: search \u2192 knowledge \u2192 execute)");
-actions.command("search <platform> <query>").description('Search for actions on a platform (e.g. one actions search gmail "send email")').option("-t, --type <type>", "execute (to run it) or knowledge (to learn about it). Default: knowledge").option("--no-cache", "Bypass the cache and re-fetch from the API (the fresh response still refreshes the cache)").action(async (platform, query, options) => {
-  await actionsSearchCommand(platform, query, options);
+var actions = program.command("actions").alias("a").description("Find, read, and execute platform actions (workflow: find \u2192 execute)");
+actions.command("find <pairs...>").alias("f").description('Find the action for every operation a task needs, across platforms, with its documentation, in one call: one actions find <platform> "<intent>" [<platform> "<intent>" ...] (up to 10 pairs). Each intent names the operation alone ("send an email"), without its data. Large documents come back as a digest; each names the exact `actions load` command for what it left out').option("--task <task>", 'The whole task in one line, in general terms (e.g. "email a report to a contact"): what it does, without names, addresses, IDs or message text. Helps choose between similar actions').option("-t, --type <type>", "execute (default: actions to run now) or knowledge (the catalog for writing code and building flows and relays, with the platform's own endpoints). Knowledge-only mode always uses knowledge").option("--ai-model <model>", "The AI model running the CLI (e.g. claude-sonnet-5), which helps optimize the documentation returned. Optional").option("--no-cache", "Bypass the cache for action documentation and re-fetch it (the fresh response still refreshes the cache)").option("--no-knowledge", "List the chosen actions (actionId, title, method, path) without their documentation; load it with `one actions load <actionId>`").action(async (pairs, options) => {
+  await actionsFindCommand(pairs, options);
 });
-actions.command("knowledge <platform> <actionId>").alias("k").description("Get docs for an action \u2014 MUST call before execute to know required params. In --agent mode returns a digest (request-building sections + a table of contents); load the rest with --section or --full").option("--section <name>", 'Return only the named section(s) \u2014 by heading, id, or alias (e.g. "Response Fields", response, optional). Repeatable or comma-separated', collect, []).option("--full", "Return the whole document instead of the digest").option("--toc", "List every section (id, heading, size) without the document").option("--no-cache", "Bypass the cache and re-fetch from the API (the fresh response still refreshes the cache)").option("--cache-status", "Print cache metadata without fetching").action(async (platform, actionId, options) => {
-  await actionsKnowledgeCommand(platform, actionId, options);
+actions.command("load <actionIds...>").alias("l").description("More of an action's documentation (up to 10 actions): the digest by default, --section for one a digest left out, --full for the whole document, --toc for its contents. Also how to read an alternative from a find answer").option("--section <name>", 'Return only the named section(s) \u2014 by heading, id, or alias (e.g. "Response Fields", response, optional). Repeatable or comma-separated', collect, []).option("--full", "Return the whole document instead of the digest").option("--toc", "List every section (id, heading, size) without the document").option("--no-cache", "Bypass the cache and re-fetch from the API (the fresh response still refreshes the cache)").option("--cache-status", "Print cache metadata without fetching").action(async (actionIds, options) => {
+  await actionsLoadCommand(actionIds, options);
 });
 actions.command("execute [platform] [actionId] [connectionKey]").alias("x").allowUnknownOption(true).allowExcessArguments(true).description("Execute an action (or multiple with --parallel, separated by --)").option("-d, --data <json>", "Request body as JSON").option("--path-vars <json>", "Path variables as JSON").option("--query-params <json>", "Query parameters as JSON").option("--headers <json>", "Additional headers as JSON").option("--form-data", "Send as multipart/form-data").option("--form-url-encoded", "Send as application/x-www-form-urlencoded").option("--dry-run", "Show request that would be sent without executing").option("--mock", "Return example response without making an API call").option("--skip-validation", "Skip input validation against the action schema").option("--no-cache", "Bypass the cached action details and re-fetch them (the fresh details still refresh the cache; execution itself is never cached)").option("--output <path>", "Save binary response to a file (for non-JSON responses like file downloads)").option("--parallel", "Execute multiple actions concurrently (separate actions with --)").option("--max-concurrency <n>", "Max concurrent actions when using --parallel (default: 5)", "5").action(async (platform, actionId, connectionKey, options) => {
   if (options.parallel) {