@withone/cli 2.10.0 → 2.11.1

package/README.md

@@ -529,14 +529,14 @@ Commit `.agents/skills/one-connect` and the agent links so your team's agents sh
 
 ### `one connect`
 
-Create and update a [One Connect](https://www.npmjs.com/package/@withone/connect) app from `one.connect.ts`, typed by `defineConnectApp` from `@withone/connect/config` (0.19.0 or later).
+Create and update a [One Connect](https://www.npmjs.com/package/@withone/connect) app from `one.connect.ts`, typed by `defineConnectApp` from `@withone/connect/config` (0.20.0 or later).
 
 ```bash
 one connect types     # writes one-connect-env.d.ts: tool slugs and action names autocomplete
 one connect create    # approve the app in the browser; re-run to review and apply changes
 ```
 
-`one connect create` opens a setup page in your signed-in browser, where you review the app (or, on a re-run, its new version) and approve it; nothing is created or changed with your API key. A new app's client secret and connect key are made there and shown once, so they never pass through the terminal. Once you approve, the CLI writes `ONE_CLIENT_ID`, `ONE_PERMISSION_SET` and `ONE_REDIRECT_URI` to `.env.local` (or `.env`). Each tool in `ask` takes `access`: `read-only`, `read-write`, `full-access`, or `custom` with `actions`, named as `one connect types` wrote them or by id from `one actions find <platform> "<what it does>" --no-knowledge`. Options: `--config <file>`, `--env-file <file>`, `--no-open`. Install `@withone/connect` (0.19.0 or later) in the project first. A `.ts` config needs Node 22.18 or later; on older Node use `one.connect.mjs`.
+`one connect create` opens a setup page in your signed-in browser, where you review the app (or, on a re-run, its new version) and approve it; nothing is created or changed with your API key. A new app's client secret and connect key are made there and shown once, so they never pass through the terminal. Once you approve, the CLI writes `ONE_CLIENT_ID`, `ONE_REDIRECT_URI` and, for a list of tools, `ONE_PERMISSION_SET` to `.env.local` (or `.env`). `ask` is required: either the tools, where each takes `access` (`read-only`, `read-write`, `full-access`, or `custom` with `actions`, named as `one connect types` wrote them or by id from `one actions find <platform> "<what it does>" --no-knowledge`), or `"everything"`, where users see every connection they have and can connect any other app. An app switched to `"everything"` loses its ask, and the CLI removes `ONE_PERMISSION_SET` from the env file. Options: `--config <file>`, `--env-file <file>`, `--no-open`. Install `@withone/connect` (0.20.0 or later) in the project first. A `.ts` config needs Node 22.18 or later; on older Node use `one.connect.mjs`.
 
 ### `one guide [topic]`
 
@@ -738,7 +738,7 @@ Drop a `.onerc` file in your project root to override global settings per-projec
 | Key | Purpose |
 |-----|---------|
 | `ONE_SECRET` | API key (also honored as env var) |
-| `ONE_API_BASE` | API base URL (also honored as env var) |
+| `ONE_API_BASE` | API base URL, `https://api.withone.ai` or `https://development-api.withone.ai` only (the env var accepts any origin) |
 | `ONE_PERMISSIONS` | `admin` / `write` / `read` |
 | `ONE_CONNECTION_KEYS` | Comma-separated connection-key allowlist |
 | `ONE_ACTION_IDS` | Comma-separated action-ID allowlist |

package/dist/{chunk-PUQKTRYC.js → chunk-5O5OUAHJ.js}

@@ -4,7 +4,7 @@ import {
 import {
   okJson,
   requireMemoryInit
-} from "./chunk-VMFWA43Q.js";
+} from "./chunk-VYOIHD4B.js";
 import {
   isAgentMode,
   note
@@ -12,7 +12,7 @@ import {
 import {
   getBackend,
   upsertRecord
-} from "./chunk-NOPTG4GC.js";
+} from "./chunk-UYOXEMF5.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{chunk-HTXZZQ6U.js → chunk-FR4VGZUI.js}

@@ -180,11 +180,32 @@ function getAccessControl() {
   return readConfig()?.accessControl ?? {};
 }
 var DEFAULT_API_BASE = "https://api.withone.ai/v1";
+var ONERC_API_HOSTS = /* @__PURE__ */ new Set(["api.withone.ai", "development-api.withone.ai"]);
+function isHostedApiOrigin(value) {
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" && ONERC_API_HOSTS.has(url.hostname) && url.port === "" && url.username === "" && url.password === "";
+  } catch {
+    return false;
+  }
+}
+var warnedOneRcApiBase = false;
+function warnIgnoredOneRcApiBase(value) {
+  if (warnedOneRcApiBase) return;
+  warnedOneRcApiBase = true;
+  process.stderr.write(
+    `Ignoring ONE_API_BASE=${value} from .onerc: only ${[...ONERC_API_HOSTS].map((h) => `https://${h}`).join(" and ")} are allowed there. Set ONE_API_BASE in the environment or apiBase in config for another backend.
+`
+  );
+}
 function getApiBase() {
   const override = process.env.ONE_API_BASE?.trim();
   if (override) return withV1(override);
   const rc = readOneRc().ONE_API_BASE?.trim();
-  if (rc) return withV1(rc);
+  if (rc) {
+    if (isHostedApiOrigin(rc)) return withV1(rc);
+    warnIgnoredOneRcApiBase(rc);
+  }
   const config = readConfig();
   if (config?.apiBase) return withV1(config.apiBase);
   return DEFAULT_API_BASE;

package/dist/{chunk-3HRC3IPE.js → chunk-NC3HVQ7O.js}

@@ -3,7 +3,7 @@ import {
   readConfig,
   setOpenAiApiKey,
   writeConfig
-} from "./chunk-HTXZZQ6U.js";
+} from "./chunk-FR4VGZUI.js";
 
 // src/lib/memory/config.ts
 var DEFAULT_MEMORY_CONFIG = {

package/dist/{chunk-5CPQHXTO.js → chunk-RUVW6QYK.js}

@@ -24,7 +24,7 @@ import {
   writeAnalyticsQueue,
   writeUsageLog,
   writeUsageState
-} from "./chunk-HTXZZQ6U.js";
+} from "./chunk-FR4VGZUI.js";
 
 // src/lib/flow-runner.ts
 import fs5 from "fs";
@@ -2977,7 +2977,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-P23IZDWM.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-36I4G5BS.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/{chunk-NOPTG4GC.js → chunk-UYOXEMF5.js}

@@ -5,11 +5,11 @@ import {
   getMemoryConfig,
   getMemoryConfigOrDefault,
   updateMemoryConfig
-} from "./chunk-3HRC3IPE.js";
+} from "./chunk-NC3HVQ7O.js";
 import {
   getOpenAiApiKey,
   homeDir
-} from "./chunk-HTXZZQ6U.js";
+} from "./chunk-FR4VGZUI.js";
 
 // src/lib/memory/schema.ts
 var SCHEMA_VERSION = "2.3.1";

package/dist/{chunk-VMFWA43Q.js → chunk-VYOIHD4B.js}

@@ -5,11 +5,11 @@ import {
 } from "./chunk-Q6PWTATS.js";
 import {
   getMemoryConfigOrDefault
-} from "./chunk-3HRC3IPE.js";
+} from "./chunk-NC3HVQ7O.js";
 import {
   getOpenAiApiKey,
   readConfig
-} from "./chunk-HTXZZQ6U.js";
+} from "./chunk-FR4VGZUI.js";
 
 // src/commands/mem/util.ts
 function requireMemoryInit() {

package/dist/{chunk-O3HDWHHS.js → chunk-WWPH6JOO.js}

@@ -1,6 +1,6 @@
 import {
   requireMemoryInit
-} from "./chunk-VMFWA43Q.js";
+} from "./chunk-VYOIHD4B.js";
 import {
   error,
   isAgentMode,
@@ -8,7 +8,7 @@ import {
 } from "./chunk-Q6PWTATS.js";
 import {
   getBackend
-} from "./chunk-NOPTG4GC.js";
+} from "./chunk-UYOXEMF5.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {

package/dist/{embedding-C7FIKORV.js → embedding-MVPO6QW7.js}

@@ -2,8 +2,8 @@ import {
   defaultSearchableText,
   embed,
   embedBatch
-} from "./chunk-3HRC3IPE.js";
-import "./chunk-HTXZZQ6U.js";
+} from "./chunk-NC3HVQ7O.js";
+import "./chunk-FR4VGZUI.js";
 export {
   defaultSearchableText,
   embed,

package/dist/{flow-runner-P23IZDWM.js → flow-runner-36I4G5BS.js}

@@ -12,10 +12,10 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-5CPQHXTO.js";
+} from "./chunk-RUVW6QYK.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-Q6PWTATS.js";
-import "./chunk-HTXZZQ6U.js";
+import "./chunk-FR4VGZUI.js";
 export {
   FlowRunner,
   collectStepTypes,

package/dist/index.js

@@ -42,10 +42,10 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-5CPQHXTO.js";
+} from "./chunk-RUVW6QYK.js";
 import {
   memSqlCommand
-} from "./chunk-O3HDWHHS.js";
+} from "./chunk-WWPH6JOO.js";
 import {
   collectIdentityKeys,
   countRecords,
@@ -76,7 +76,7 @@ import {
   writeDraftProfile,
   writePageToMemory,
   writeProfile
-} from "./chunk-PUQKTRYC.js";
+} from "./chunk-5O5OUAHJ.js";
 import {
   getByDotPath
 } from "./chunk-44CV5IMX.js";
@@ -90,7 +90,7 @@ import {
   requireMemoryInit,
   semanticSearchUpgradeHint,
   semanticSearchUpgradeLine
-} from "./chunk-VMFWA43Q.js";
+} from "./chunk-VYOIHD4B.js";
 import {
   cancel,
   createSpinner,
@@ -112,7 +112,7 @@ import {
   listBackendPlugins,
   loadBackendFromConfig,
   updateRecord
-} from "./chunk-NOPTG4GC.js";
+} from "./chunk-UYOXEMF5.js";
 import {
   DEFAULT_MEMORY_CONFIG,
   defaultSearchableText,
@@ -122,7 +122,7 @@ import {
   memoryConfigExists,
   setOpenAiApiKey,
   updateMemoryConfig
-} from "./chunk-3HRC3IPE.js";
+} from "./chunk-NC3HVQ7O.js";
 import {
   configExists,
   ensureWhoAmI,
@@ -148,7 +148,7 @@ import {
   updateApiBase,
   updateWhoAmI,
   writeConfig
-} from "./chunk-HTXZZQ6U.js";
+} from "./chunk-FR4VGZUI.js";
 
 // src/cli.ts
 import { createRequire } from "module";
@@ -6015,6 +6015,9 @@ import zlib from "zlib";
 import { pathToFileURL } from "url";
 var CONFIG_FILES = ["one.connect.ts", "one.connect.mts", "one.connect.mjs", "one.connect.js"];
 var TYPES_FILE = "one-connect-env.d.ts";
+function askedTools(config2) {
+  return config2.ask === "everything" ? [] : Object.entries(config2.ask ?? {});
+}
 var ACCESS_METHODS = {
   "read-only": ["GET"],
   "read-write": ["GET", "POST", "PUT", "PATCH"],
@@ -6077,7 +6080,18 @@ function validateConfig(value) {
       if (!HEX_COLOR.test(String(v.branding[key] ?? ""))) errors.push(`\`branding.${key}\` must be a #RRGGBB colour.`);
     }
   }
-  for (const [tool, ask] of Object.entries(v.ask ?? {})) {
+  const asked = v.ask;
+  if (asked === void 0) {
+    errors.push('`ask` is required: name the tools the app asks for, or write `ask: "everything"`.');
+  } else if (typeof asked === "string") {
+    if (asked !== "everything") errors.push(`\`ask\` is "${asked}"; it must be a map of tools or "everything".`);
+  } else if (!asked || typeof asked !== "object" || Array.isArray(asked)) {
+    errors.push('`ask` must be a map of tools or "everything".');
+  } else if (Object.keys(asked).length === 0) {
+    errors.push('`ask` names no tools. Name at least one, or write `ask: "everything"`.');
+  }
+  const tools = asked && typeof asked === "object" && !Array.isArray(asked) ? Object.entries(asked) : [];
+  for (const [tool, ask] of tools) {
     const access = ask?.access;
     if (access === "custom") {
       const actions2 = ask.actions;
@@ -6134,7 +6148,11 @@ function clientFields(config2) {
   return fields;
 }
 function buildHandoff(config2, rules) {
-  return { v: 1, app: clientFields(config2), ask: rules.length > 0 ? rules : null };
+  return {
+    v: 2,
+    app: clientFields(config2),
+    ask: config2.ask === "everything" ? { kind: "everything" } : { kind: "tools", rules }
+  };
 }
 function encodeHandoff(handoff) {
   return zlib.deflateRawSync(Buffer.from(JSON.stringify(handoff), "utf8"), { level: 9 }).toString("base64url");
@@ -6165,6 +6183,10 @@ function upsertEnv(text5, values) {
   return `${next}${separator}${appended.join("\n")}
 `;
 }
+function removeEnvKeys(text5, keys) {
+  return keys.reduce((next, key) => next.replace(new RegExp(`^${key}=.*(?:\r?
+|$)`, "m"), ""), text5);
+}
 function renderTypes(tools, actionsByTool) {
   const literal = (value) => JSON.stringify(value);
   const union = (values) => values.length > 0 ? values.map(literal).join(" | ") : "never";
@@ -6214,7 +6236,7 @@ function message(error2) {
   return error2 instanceof Error ? error2.message : String(error2);
 }
 async function buildRules(api, config2) {
-  const asked = Object.entries(config2.ask ?? {});
+  const asked = askedTools(config2);
   if (asked.length === 0) return [];
   const platforms = await api.listPlatforms();
   const idBySlug = new Map(platforms.map((p9) => [p9.platform, p9.id]));
@@ -6302,19 +6324,21 @@ async function connectCreateCommand(options) {
     if (outcome.kind === "cancelled") error("Cancelled in the browser. Nothing was changed.");
     if (outcome.kind === "failed") error(`The setup page reported: ${outcome.reason}`);
     const created = outcome.outcome === "created";
+    const asksForEverything = config2.ask === "everything";
     fs6.writeFileSync(
       envFile,
-      upsertEnv(envText, {
+      upsertEnv(asksForEverything ? removeEnvKeys(envText, ["ONE_PERMISSION_SET"]) : envText, {
         ONE_CLIENT_ID: outcome.clientId,
         ONE_REDIRECT_URI: config2.redirectUris[0],
-        ...outcome.permissionSetId ? { ONE_PERMISSION_SET: outcome.permissionSetId } : {},
+        ...!asksForEverything && outcome.permissionSetId ? { ONE_PERMISSION_SET: outcome.permissionSetId } : {},
         ...created ? { ONE_CLIENT_SECRET: null, ONE_CONNECT_KEY: null } : {}
       })
     );
     const result = {
       outcome: outcome.outcome,
       clientId: outcome.clientId,
-      permissionSetId: outcome.permissionSetId,
+      permissionSetId: asksForEverything ? null : outcome.permissionSetId,
+      asksForEverything,
       redirectUris: config2.redirectUris,
       envFile: path6.relative(cwd, envFile) || envFile
     };
@@ -6327,7 +6351,8 @@ async function connectCreateCommand(options) {
     );
     console.log();
     console.log(`  ${pc10.dim("Client ID:")}       ${outcome.clientId}`);
-    if (outcome.permissionSetId) console.log(`  ${pc10.dim("Permission set:")}  ${outcome.permissionSetId}`);
+    if (asksForEverything) console.log(`  ${pc10.dim("Asks for:")}        everything the user has connected`);
+    else if (outcome.permissionSetId) console.log(`  ${pc10.dim("Permission set:")}  ${outcome.permissionSetId}`);
     console.log(`  ${pc10.dim("Wrote")}            ${result.envFile}`);
     if (created) {
       console.log(`  ${pc10.dim("The two secrets came from the browser page, never through here.")}`);
@@ -6349,7 +6374,7 @@ async function connectTypesCommand(options) {
   try {
     const file = findConfigFile(cwd, options.config);
     const config2 = file ? validateConfig(await loadConfigFile(file)) : null;
-    const tools = Object.keys(config2 && "config" in config2 ? config2.config.ask ?? {} : {});
+    const tools = config2 && "config" in config2 ? askedTools(config2.config).map(([slug]) => slug) : [];
     const platforms = await api.listPlatforms();
     const known = new Set(platforms.map((p9) => p9.platform));
     const actionsByTool = {};
@@ -7402,7 +7427,7 @@ async function syncModel(api, profile, options) {
         updateModelState(platform, model, { status: "failed", pagesProcessed, lastCursor }),
         (async () => {
           try {
-            const { getBackend: getBackend2 } = await import("./runtime-HLW365HP.js");
+            const { getBackend: getBackend2 } = await import("./runtime-J4TQCY7Z.js");
             const backend = await getBackend2();
             await Promise.race([
               backend.close(),
@@ -7768,7 +7793,7 @@ async function syncModel(api, profile, options) {
         db.exec(`DROP TABLE IF EXISTS _seen_ids`);
       }
       if (options.toMemory !== false) {
-        const backend = await (await import("./runtime-HLW365HP.js")).getBackend();
+        const backend = await (await import("./runtime-J4TQCY7Z.js")).getBackend();
         const type = `${platform}/${model}`;
         const existing = await backend.listKeysByType(type);
         const sourcePrefix = `${type}:`;
@@ -7869,7 +7894,7 @@ async function syncModel(api, profile, options) {
     let statusCounts;
     if (options.toMemory !== false) {
       try {
-        const backend = await (await import("./runtime-HLW365HP.js")).getBackend();
+        const backend = await (await import("./runtime-J4TQCY7Z.js")).getBackend();
         const typeName = `${platform}/${model}`;
         const [active, archived] = await Promise.all([
           backend.count(typeName, { status: "active" }),
@@ -9591,7 +9616,7 @@ ${result.total} results`);
   }
 }
 async function syncSqlCommand(platformModel, sql) {
-  const { syncSqlCommand: runSyncSql } = await import("./sql-NDMMFQP6.js");
+  const { syncSqlCommand: runSyncSql } = await import("./sql-XCMEVSVD.js");
   await runSyncSql(platformModel, sql);
 }
 async function syncDeleteCommand(platformModel, options) {
@@ -9669,7 +9694,7 @@ async function syncDeleteCommand(platformModel, options) {
 async function maybeAutoMigrateLegacy(platform, models) {
   const dbSize = getDatabaseSize(platform);
   if (!dbSize || dbSize === "0 B") return;
-  const { getBackend: getBackend2 } = await import("./runtime-HLW365HP.js");
+  const { getBackend: getBackend2 } = await import("./runtime-J4TQCY7Z.js");
   const backend = await getBackend2();
   let memoryHasData = false;
   for (const model of models) {
@@ -9685,7 +9710,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
       `  detected legacy .one/sync/data/${platform}.db (${dbSize}) \u2014 auto-migrating into memory before sync.
 `
     );
-    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-KWEEEQ3E.js");
+    const { memMigrateCommand: memMigrateCommand3 } = await import("./migrate-IKK2N3VW.js");
     await memMigrateCommand3({ platform, yes: true });
     return;
   }
@@ -9694,7 +9719,7 @@ async function maybeAutoMigrateLegacy(platform, models) {
     initialValue: true
   });
   if (p6.isCancel(shouldMigrate) || !shouldMigrate) return;
-  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-KWEEEQ3E.js");
+  const { memMigrateCommand: memMigrateCommand2 } = await import("./migrate-IKK2N3VW.js");
   await memMigrateCommand2({ platform, yes: true });
 }
 async function syncSuggestSearchableCommand(platformModel, options = {}) {
@@ -9755,7 +9780,7 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
 async function syncListCommand(platform) {
   const profiles = listProfiles(platform);
   const state = await readSyncState();
-  const { getBackend: getBackend2 } = await import("./runtime-HLW365HP.js");
+  const { getBackend: getBackend2 } = await import("./runtime-J4TQCY7Z.js");
   const backend = await getBackend2();
   const syncs = await Promise.all(profiles.map(async (p9) => {
     const modelState = state[p9.platform]?.[p9.model];
@@ -10031,7 +10056,7 @@ function registerSyncSubcommands(sync) {
     await syncSqlCommand(platformModel, sql);
   });
   sync.command("schema <platform/model>").description("Inspect the JSON structure of synced records (field paths, types, examples) \u2014 useful before writing `sync sql` queries").action(async (platformModel) => {
-    const { syncSchemaCommand } = await import("./schema-YJ7JTGFL.js");
+    const { syncSchemaCommand } = await import("./schema-JKYKFQZD.js");
     await syncSchemaCommand(platformModel);
   });
   sync.command("delete <platform/model>").description('Delete records from local sync data (e.g. one sync delete notion/pages --id "abc-123")').option("--id <value>", "Delete record by ID").option("--where <conditions>", 'Delete records matching conditions (e.g. "status=archived")').option("--where-sql <predicate>", `Delete using a raw SQL WHERE clause (e.g. "json_extract(data, '$.type') = 'promotion'")`).option("--yes", "Skip confirmation prompt").action(async (platformModel, options) => {
@@ -10808,7 +10833,7 @@ async function memDoctorCommand() {
   }
   if (cfg.embedding.provider === "openai") {
     try {
-      const { embed: embed2 } = await import("./embedding-C7FIKORV.js");
+      const { embed: embed2 } = await import("./embedding-MVPO6QW7.js");
       const result = await embed2("connectivity check");
       checks.push({
         name: "OpenAI embedding provider reachable",
@@ -11380,7 +11405,7 @@ one --agent relay deliveries --endpoint-id <id>                 # Check delivery
 - Use \`actions find\` (and \`actions load\` for more) to learn both the incoming payload shape AND the destination API shape before building templates
 
 ### One Connect apps \u2014 created from \`one.connect.ts\`
-\`one connect create\` reads \`one.connect.ts\`, typed by \`defineConnectApp\` from \`@withone/connect/config\` (install \`@withone/connect\` 0.19.0 or later in the project first), and opens a setup page where the human reviews the app (or, once .env holds its \`ONE_CLIENT_ID\`, its new version) and approves it with their dashboard session; an API key never creates or changes a Connect app. A new app's client secret and connect key are made and shown there once; the CLI never receives them. It waits up to 10 minutes, then writes \`ONE_CLIENT_ID\`, \`ONE_PERMISSION_SET\` and \`ONE_REDIRECT_URI\` to the env file. \`one connect types\` writes \`one-connect-env.d.ts\` so tool slugs and action names autocomplete. Each tool's \`access\` is \`read-only\`, \`read-write\`, \`full-access\`, or \`custom\` with \`actions\` (names, or ids from \`actions find\`).
+\`one connect create\` reads \`one.connect.ts\`, typed by \`defineConnectApp\` from \`@withone/connect/config\` (install \`@withone/connect\` 0.20.0 or later in the project first), and opens a setup page where the human reviews the app (or, once .env holds its \`ONE_CLIENT_ID\`, its new version) and approves it with their dashboard session; an API key never creates or changes a Connect app. A new app's client secret and connect key are made and shown there once; the CLI never receives them. It waits up to 10 minutes, then writes \`ONE_CLIENT_ID\`, \`ONE_REDIRECT_URI\` and, for a list of tools, \`ONE_PERMISSION_SET\` to the env file. \`one connect types\` writes \`one-connect-env.d.ts\` so tool slugs and action names autocomplete. \`ask\` is required: the tools, each with \`access\` \`read-only\`, \`read-write\`, \`full-access\`, or \`custom\` with \`actions\` (names, or ids from \`actions find\`), or \`"everything"\`, which asks for every connection the user has and removes \`ONE_PERMISSION_SET\` from the env file.
 
 ### 4. Memory + Sync \u2014 Unified store with hybrid FTS + semantic search
 One ships a local memory store (a real Postgres process bootstrapped on demand via the bundled \`embedded-postgres\` plugin, with a \`postgres\` plugin for remote/self-hosted) that backs both user-authored notes (\`one mem add\`) and synced platform data (\`one sync run\`). Auto-initializes on first use \u2014 no separate install step. Run \`one guide memory\` and \`one guide sync\` for the full references.

package/dist/{migrate-KWEEEQ3E.js → migrate-IKK2N3VW.js}

@@ -3,13 +3,13 @@ import {
   dotPathToJsonbExpr,
   memMigrateCommand,
   reviveStringifiedJson
-} from "./chunk-PUQKTRYC.js";
+} from "./chunk-5O5OUAHJ.js";
 import "./chunk-44CV5IMX.js";
-import "./chunk-VMFWA43Q.js";
+import "./chunk-VYOIHD4B.js";
 import "./chunk-Q6PWTATS.js";
-import "./chunk-NOPTG4GC.js";
-import "./chunk-3HRC3IPE.js";
-import "./chunk-HTXZZQ6U.js";
+import "./chunk-UYOXEMF5.js";
+import "./chunk-NC3HVQ7O.js";
+import "./chunk-FR4VGZUI.js";
 export {
   buildIdentityMap,
   dotPathToJsonbExpr,

package/dist/{runtime-HLW365HP.js → runtime-J4TQCY7Z.js}

@@ -5,9 +5,9 @@ import {
   resetBackendSingleton,
   updateRecord,
   upsertRecord
-} from "./chunk-NOPTG4GC.js";
-import "./chunk-3HRC3IPE.js";
-import "./chunk-HTXZZQ6U.js";
+} from "./chunk-UYOXEMF5.js";
+import "./chunk-NC3HVQ7O.js";
+import "./chunk-FR4VGZUI.js";
 export {
   addRecord,
   closeBackendIfCached,

package/dist/{schema-YJ7JTGFL.js → schema-JKYKFQZD.js}

@@ -1,16 +1,16 @@
 import {
   okJson,
   requireMemoryInit
-} from "./chunk-VMFWA43Q.js";
+} from "./chunk-VYOIHD4B.js";
 import {
   isAgentMode,
   note
 } from "./chunk-Q6PWTATS.js";
 import {
   getBackend
-} from "./chunk-NOPTG4GC.js";
-import "./chunk-3HRC3IPE.js";
-import "./chunk-HTXZZQ6U.js";
+} from "./chunk-UYOXEMF5.js";
+import "./chunk-NC3HVQ7O.js";
+import "./chunk-FR4VGZUI.js";
 
 // src/lib/memory/sync/schema.ts
 import pc from "picocolors";

package/dist/sql-XCMEVSVD.js

@@ -0,0 +1,13 @@
+import {
+  memSqlCommand,
+  syncSqlCommand
+} from "./chunk-WWPH6JOO.js";
+import "./chunk-VYOIHD4B.js";
+import "./chunk-Q6PWTATS.js";
+import "./chunk-UYOXEMF5.js";
+import "./chunk-NC3HVQ7O.js";
+import "./chunk-FR4VGZUI.js";
+export {
+  memSqlCommand,
+  syncSqlCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.10.0",
+  "version": "2.11.1",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/SKILL.md

@@ -377,10 +377,10 @@ To create the Connect app itself without the dashboard, install `@withone/connec
 
 ```bash
 one --agent connect types      # tool slugs and action names autocomplete in one.connect.ts
-one --agent connect create     # the human approves it in the browser; then writes ONE_CLIENT_ID, ONE_PERMISSION_SET, ONE_REDIRECT_URI to .env
+one --agent connect create     # the human approves it in the browser; then writes ONE_CLIENT_ID, ONE_REDIRECT_URI and (for a list of tools) ONE_PERMISSION_SET to .env
 ```
 
-It opens a setup page in the human's browser and waits up to 10 minutes, so run it in the background or with a long timeout; the link is printed to stderr at once, so pass it on if no browser opened. The human reviews the app (or, on a re-run, its new version) and approves it with their dashboard session: an API key never creates or changes a Connect app. For a new app the page also makes `ONE_CLIENT_SECRET` and `ONE_CONNECT_KEY` and shows them once; tell the human to copy them into the env file the result names. The CLI never receives either secret. Run `connect create` again after editing the file to update the same app.
+It opens a setup page in the human's browser and waits up to 10 minutes, so run it in the background or with a long timeout; the link is printed to stderr at once, so pass it on if no browser opened. The human reviews the app (or, on a re-run, its new version) and approves it with their dashboard session: an API key never creates or changes a Connect app. For a new app the page also makes `ONE_CLIENT_SECRET` and `ONE_CONNECT_KEY` and shows them once; tell the human to copy them into the env file the result names. The CLI never receives either secret. Run `connect create` again after editing the file to update the same app. `ask` is required: the tools the app asks for, or `"everything"` (users see every connection they have and can connect any other app; the CLI then removes `ONE_PERMISSION_SET` from the env file).
 
 ## Adding New Connections
 

package/dist/sql-NDMMFQP6.js

@@ -1,13 +0,0 @@
-import {
-  memSqlCommand,
-  syncSqlCommand
-} from "./chunk-O3HDWHHS.js";
-import "./chunk-VMFWA43Q.js";
-import "./chunk-Q6PWTATS.js";
-import "./chunk-NOPTG4GC.js";
-import "./chunk-3HRC3IPE.js";
-import "./chunk-HTXZZQ6U.js";
-export {
-  memSqlCommand,
-  syncSqlCommand
-};