@withone/cli 2.12.0 → 2.14.0

package/dist/{chunk-7ZBRP3BJ.js → chunk-IM3OA7CU.js}

@@ -29,7 +29,7 @@ import {
   writeAnalyticsQueue,
   writeUsageLog,
   writeUsageState
-} from "./chunk-EWHFGWB3.js";
+} from "./chunk-XUAUDMQE.js";
 
 // src/lib/flow-runner.ts
 import fs5 from "fs";
@@ -40,7 +40,7 @@ import crypto from "crypto";
 import fs4 from "fs";
 import os2 from "os";
 import path5 from "path";
-import { exec, spawn } from "child_process";
+import { exec, spawn as spawn2 } from "child_process";
 import { promisify } from "util";
 
 // src/lib/install-context.ts
@@ -1506,8 +1506,8 @@ var FLOW_SCHEMA = {
       configKey: "code",
       description: "JS code \u2014 inline source or an external .mjs module under the flow's lib/ folder",
       fields: {
-        source: { type: "string", required: false, description: 'Inline JS function body (flow context as $, supports await). Mutually exclusive with "module".' },
-        module: { type: "string", required: false, description: 'Relative path to a .mjs file under the flow folder (e.g. "lib/normalize.mjs"). Reads $ from stdin as JSON, writes result to stdout as JSON. Mutually exclusive with "source".' }
+        source: { type: "string", required: false, description: 'Inline JS function body (flow context as $, supports await). Runs in the sandbox: no files, programs, network or timers. Mutually exclusive with "module".' },
+        module: { type: "string", required: false, description: 'Relative path to a .mjs file under the flow folder (e.g. "lib/normalize.mjs"). Reads $ from stdin as JSON, writes result to stdout as JSON. Mutually exclusive with "source". Runs with full Node access and requires --allow-code.' }
       },
       example: {
         id: "processData",
@@ -1735,7 +1735,7 @@ function generateFlowGuide() {
 Workflows live in \`.one/flows/\` (relative to your current working directory \u2014 the CLI does NOT walk up parent directories or fall back to a global location) and chain actions across platforms. Two layouts are supported:
 
 - **Folder layout (REQUIRED for new flows)** \u2014 \`.one/flows/<key>/flow.json\`, with an optional \`lib/\` subfolder for JavaScript modules. This is like a skill: the folder groups the JSON spec with any JavaScript modules it needs, so the whole flow is shareable. **Always create new flows in this layout.**
-- **Single-file layout (DEPRECATED)** \u2014 \`.one/flows/<key>.flow.json\`. Still loads and runs for backward compatibility, but is deprecated. Do not create new flows in this layout. When editing an existing single-file flow, migrate it to the folder layout: move \`<key>.flow.json\` to \`<key>/flow.json\` and extract any non-trivial \`code.source\` blocks into \`<key>/lib/*.mjs\` modules.
+- **Single-file layout (DEPRECATED)** \u2014 \`.one/flows/<key>.flow.json\`. Still loads and runs for backward compatibility, but is deprecated. Do not create new flows in this layout. When editing an existing single-file flow, migrate it to the folder layout: move \`<key>.flow.json\` to \`<key>/flow.json\`. Move a \`code.source\` block into a \`<key>/lib/*.mjs\` module only if it needs files, network or timers: modules run with full Node access and make the flow require \`--allow-code\`.
 
 **Subdirectory groups** \u2014 Flows can be organized into subdirectories: \`.one/flows/<group>/<key>/flow.json\`. For example:
 \`\`\`
@@ -1755,16 +1755,17 @@ When resolving a flow by key, the CLI checks the folder layout first, then the d
 **Agents: always inspect a flow before running it.** Nothing about a flow's runtime requirements is guessable from its name. Before \`flow execute\`, do one of these:
 
 1. Run \`one --agent flow list\` \u2014 the JSON output includes \`requiresBash\`, \`usesCodeModules\`, \`inputs\` (with \`autoResolvable\` flags), \`stepTypes\`, and the flow's \`description\`. This is the fastest path.
-2. Read the flow's \`description\` field directly from the JSON. Flow authors are required (see "Author conventions" below) to state any \`--allow-bash\` requirement and any non-auto-resolving inputs in the description.
+2. Read the flow's \`description\` field directly from the JSON. Flow authors are required (see "Author conventions" below) to state any \`--allow-bash\` or \`--allow-code\` requirement and any non-auto-resolving inputs in the description.
 3. Run \`one --agent flow execute <key> --dry-run\` to see the resolved inputs and step plan without side effects.
 
-If you skip this step you will hit errors like *"Workflow X contains bash steps. Re-run with --allow-bash."* \u2014 the CLI now pre-flights and fails fast, so you won't waste a long run, but the error is still avoidable by reading first.
+If you skip this step you will hit errors like *"Workflow X contains bash steps. Re-run with --allow-bash."* (or the same for \`code.module\` steps and \`--allow-code\`) \u2014 the CLI now pre-flights and fails fast, so you won't waste a long run, but the error is still avoidable by reading first.
 
 ## Author conventions \u2014 WRITE flows that are safe to execute blind
 
 When you create a flow, its \`description\` field is the contract with future executors (human or agent). It MUST state:
 
 - **\`--allow-bash\` if any step is type \`bash\`.** Example: *"Fetches recent Gmail threads and summarizes them with Claude Haiku. Requires \`--allow-bash\`."*
+- **\`--allow-code\` if any code step uses \`code.module\`.** Modules run with full Node access, so they are gated like bash.
 - **Every input that does NOT have a \`connection\` hint.** Connection inputs auto-resolve when exactly one matching connection exists; everything else must be passed via \`-i name=value\` and the description must name it.
 - **Any files/directories the flow writes to** so operators know what will be modified on disk.
 
@@ -1782,6 +1783,7 @@ one --agent flow execute <key> -i name=value                     # Execute (bare
 one --agent flow execute <group/key> -i name=value               # Execute (namespaced key)
 one --agent flow execute <key> --dry-run --mock                  # Test with mock data
 one --agent flow execute <key> --allow-bash                      # Enable bash steps
+one --agent flow execute <key> --allow-code                      # Enable code.module steps (full Node)
 one --agent flow runs [flowKey]                                  # List past runs
 one --agent flow resume <runId>                                  # Resume failed run
 one --agent flow scaffold [template]                             # Generate a starter template
@@ -1828,7 +1830,7 @@ If you're editing an existing \`.one/flows/<key>.flow.json\`, migrate it \u2014
 
 1. \`mkdir -p .one/flows/<key>/lib\`
 2. Move the file: \`mv .one/flows/<key>.flow.json .one/flows/<key>/flow.json\`
-3. For each non-trivial \`code\` step with inline \`source\`, extract it into \`lib/<step-id>.mjs\` (see translation pattern below) and swap the step config from \`{ "source": "..." }\` to \`{ "module": "lib/<step-id>.mjs" }\`. One-liners can stay inline.
+3. Leave inline \`code.source\` in place unless it needs files, network or timers; it runs in the sandbox and needs no flag. If it does need them, extract it into \`lib/<step-id>.mjs\` (see translation pattern below) and swap the step config to \`{ "module": "lib/<step-id>.mjs" }\`. That gives it full Node access and makes the flow require \`--allow-code\`.
 4. Validate: \`one --agent flow validate <key>\`.
 5. Run it and confirm behavior is unchanged.
 
@@ -2196,13 +2198,272 @@ Set timeout to at least 180000ms (3 min). Run Claude-heavy flows sequentially, n
 
 - Connection keys are **inputs**, not hardcoded
 - Action IDs in examples are placeholders \u2014 always use \`actions find\`
-- Inline \`code.source\` steps allow \`require('crypto' | 'buffer' | 'url' | 'path')\` \u2014 \`fs\`, \`http\`, \`child_process\` are blocked
-- For anything beyond one-liners, use \`code.module\` to point at a \`.mjs\` file in the flow's \`lib/\` folder \u2014 runs as a child \`node\` process with full Node APIs, reads \`$\` from stdin, writes JSON to stdout
+- Transforms, conditions, \`if\`/\`unless\` and inline \`code.source\` run in a sandbox (separate process, no files, programs, network or environment of its own). \`code.source\` allows \`require('crypto' | 'buffer' | 'url' | 'path')\` \u2014 \`fs\`, \`http\`, \`child_process\` are blocked. \`$\` is a copy: return a value, don't mutate \`$\`
+- When a step needs files, network or timers, use \`code.module\` to point at a \`.mjs\` file in the flow's \`lib/\` folder \u2014 runs as a child \`node\` process with full Node APIs, reads \`$\` from stdin, writes JSON to stdout. Requires \`--allow-code\`
 - Bash steps require \`--allow-bash\` flag
 - State is persisted after every step \u2014 resume picks up where it left off`);
   return sections.join("\n");
 }
 
+// src/lib/flow-sandbox.ts
+import { spawn } from "child_process";
+var syncTimeoutMs = 3e4;
+var callTimeoutMs = 6e4;
+var SANDBOX_NODE_FLAGS = ["--permission", "--disallow-code-generation-from-strings"];
+function sandboxEnv() {
+  if (process.platform === "win32" && process.env.SystemRoot) return { SystemRoot: process.env.SystemRoot };
+  return {};
+}
+var BOOTSTRAP = String.raw`
+'use strict';
+const vm = require('node:vm');
+const proc = process;
+const MODULES = {
+  buffer: require('node:buffer'),
+  crypto: require('node:crypto'),
+  url: require('node:url'),
+  path: require('node:path'),
+};
+const BLOCKED = new Set(['fs', 'http', 'https', 'net', 'child_process', 'process', 'os',
+  'cluster', 'dgram', 'tls', 'vm', 'worker_threads']);
+const sandboxRequire = async (name) => {
+  const clean = String(name).replace(/^node:/, '');
+  if (BLOCKED.has(clean)) throw new Error('Module "' + name + '" is blocked in code steps');
+  if (!Object.prototype.hasOwnProperty.call(MODULES, clean)) {
+    throw new Error('Module "' + name + '" not available. Allowed: ' + Object.keys(MODULES).join(', '));
+  }
+  return MODULES[clean];
+};
+const SYNC_TIMEOUT = Number(proc.argv[proc.argv.length - 1]) || 30000;
+const send = proc.send.bind(proc);
+
+for (const k of ['process', 'require', 'module', 'exports', '__filename', '__dirname',
+  'fetch', 'WebSocket', 'EventSource', 'Request', 'Response', 'Headers', 'FormData',
+  'setTimeout', 'setInterval', 'setImmediate', 'clearTimeout', 'clearInterval',
+  'clearImmediate', 'navigator', 'global']) {
+  try { delete globalThis[k]; } catch (_) { /* non-configurable: leave it */ }
+}
+
+const describe = (err) => {
+  if (err && typeof err === 'object') {
+    return { name: String(err.name || 'Error'), message: String(err.message), stack: String(err.stack || '') };
+  }
+  return { name: 'Error', message: String(err), stack: '' };
+};
+
+const reply = (id, value) => {
+  try {
+    send({ id, ok: true, value });
+  } catch (err) {
+    send({ id, ok: false, error: { name: 'Error', stack: '', message:
+      'returned a value that cannot be copied out of the sandbox (functions, symbols and class instances with private state cannot be passed between steps): ' + (err && err.message) } });
+  }
+};
+
+// The sandbox's copy of $. The host sends only the parts that changed since
+// the last call (see syncFor in flow-sandbox.ts), so a loop over a large
+// step output doesn't copy that output again on every iteration.
+let store = { input: {}, env: {}, steps: {}, loop: {} };
+const applySync = (sync) => {
+  if (sync.reset) store = { input: {}, env: {}, steps: {}, loop: {} };
+  if ('input' in sync) store.input = sync.input;
+  if ('env' in sync) store.env = sync.env;
+  if ('loop' in sync) store.loop = sync.loop;
+  if (sync.steps) for (const k of Object.keys(sync.steps)) store.steps[k] = sync.steps[k];
+  if (sync.drop) for (const k of sync.drop) delete store.steps[k];
+};
+
+proc.on('message', async (msg) => {
+  const { id, kind, code, sync, filename } = msg;
+  try {
+    applySync(sync);
+    globalThis.__one_ctx = store;
+    globalThis.__one_require = sandboxRequire;
+    let value;
+    if (kind === 'expr') {
+      const script = new vm.Script('(function ($) { return (' + code + '\n) })(__one_ctx)', { filename: filename || 'expression' });
+      value = script.runInThisContext({ timeout: SYNC_TIMEOUT });
+    } else {
+      // Same wrapper shape as new AsyncFunction('$', 'require', body), so
+      // stack line numbers are offset by exactly 2, as the engine expects.
+      const script = new vm.Script('(async function anonymous($,require\n) {\n' + code + '\n})(__one_ctx, __one_require)', { filename });
+      value = await script.runInThisContext({ timeout: SYNC_TIMEOUT });
+    }
+    reply(id, value);
+  } catch (err) {
+    send({ id, ok: false, error: describe(err) });
+  } finally {
+    delete globalThis.__one_ctx;
+    delete globalThis.__one_require;
+  }
+});
+send({ ready: true });
+`;
+var child = null;
+var ready = null;
+var nextId = 1;
+var pending2 = /* @__PURE__ */ new Map();
+var ERROR_CTORS = {
+  TypeError,
+  SyntaxError,
+  ReferenceError,
+  RangeError,
+  EvalError,
+  URIError
+};
+function rebuildError(e) {
+  const Ctor = ERROR_CTORS[e.name] ?? Error;
+  const err = new Ctor(e.message);
+  if (!ERROR_CTORS[e.name] && e.name && e.name !== "Error") err.name = e.name;
+  if (e.stack) err.stack = e.stack;
+  return err;
+}
+function setRef(on) {
+  if (!child) return;
+  const channel = child.channel;
+  if (on) {
+    child.ref();
+    channel?.ref();
+  } else {
+    child.unref();
+    channel?.unref();
+  }
+}
+function failAll(proc, err) {
+  for (const [id, p] of pending2) {
+    if (p.proc !== proc) continue;
+    clearTimeout(p.timer);
+    pending2.delete(id);
+    p.reject(err);
+  }
+}
+function start() {
+  if (ready) return ready;
+  const proc = spawn(
+    process.execPath,
+    [...SANDBOX_NODE_FLAGS, "-e", BOOTSTRAP, "--", String(syncTimeoutMs)],
+    {
+      stdio: ["ignore", "inherit", "inherit", "ipc"],
+      serialization: "advanced",
+      env: sandboxEnv(),
+      windowsHide: true
+    }
+  );
+  child = proc;
+  ready = new Promise((resolve2, reject) => {
+    const onReady = (msg) => {
+      if (msg && typeof msg === "object" && msg.ready) {
+        proc.off("message", onReady);
+        resolve2();
+      }
+    };
+    proc.on("message", onReady);
+    proc.once("error", (err) => reject(new Error(`Could not start the flow code sandbox: ${err.message}`)));
+    proc.once("exit", (code, signal) => {
+      reject(new Error(`Flow code sandbox exited before it was ready (code ${code}, signal ${signal})`));
+    });
+  });
+  proc.on("message", (msg) => {
+    if (typeof msg?.id !== "number") return;
+    const p = pending2.get(msg.id);
+    if (!p) return;
+    clearTimeout(p.timer);
+    pending2.delete(msg.id);
+    if (pending2.size === 0) setRef(false);
+    if (msg.ok) p.resolve(msg.value);
+    else p.reject(rebuildError(msg.error ?? { name: "Error", message: "unknown sandbox error", stack: "" }));
+  });
+  proc.on("exit", (code, signal) => {
+    if (child === proc) {
+      child = null;
+      ready = null;
+    }
+    failAll(proc, new Error(`Flow code sandbox stopped (code ${code}, signal ${signal})`));
+  });
+  proc.on("error", (err) => {
+    if (child === proc) {
+      child = null;
+      ready = null;
+    }
+    failAll(proc, err);
+  });
+  return ready;
+}
+var synced = null;
+function syncFor(proc, context) {
+  const prev = synced && synced.proc === proc && synced.context === context && synced.stepsObj === context.steps ? synced : null;
+  const sync = {};
+  if (!prev) sync.reset = true;
+  if (!prev || prev.input !== context.input) sync.input = context.input;
+  if (!prev || prev.env !== context.env) sync.env = context.env;
+  if (!prev || prev.loop !== context.loop) sync.loop = context.loop;
+  const stepUpdates = {};
+  let anyStep = false;
+  const nextSteps = /* @__PURE__ */ new Map();
+  for (const [k, v] of Object.entries(context.steps)) {
+    nextSteps.set(k, v);
+    if (!prev || prev.steps.get(k) !== v) {
+      stepUpdates[k] = v;
+      anyStep = true;
+    }
+  }
+  if (anyStep) sync.steps = stepUpdates;
+  if (prev) {
+    const drop = [...prev.steps.keys()].filter((k) => !nextSteps.has(k));
+    if (drop.length) sync.drop = drop;
+  }
+  const commit = () => {
+    synced = {
+      proc,
+      context,
+      stepsObj: context.steps,
+      input: context.input,
+      env: context.env,
+      loop: context.loop,
+      steps: nextSteps
+    };
+  };
+  return { sync, commit };
+}
+async function call(kind, code, context, filename) {
+  await start();
+  const proc = child;
+  const id = nextId++;
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      pending2.delete(id);
+      reject(new Error(`timed out after ${callTimeoutMs / 1e3}s`));
+      if (child === proc) {
+        child = null;
+        ready = null;
+      }
+      proc.kill();
+    }, callTimeoutMs);
+    timer.unref();
+    pending2.set(id, { resolve: resolve2, reject, timer, proc });
+    setRef(true);
+    const { sync, commit } = syncFor(proc, context);
+    try {
+      proc.send({ id, kind, code, sync, filename });
+      commit();
+    } catch (err) {
+      synced = null;
+      clearTimeout(timer);
+      pending2.delete(id);
+      if (pending2.size === 0) setRef(false);
+      reject(new Error(
+        `the flow context contains a value that cannot be passed to the sandbox: ${err.message}`
+      ));
+    }
+  });
+}
+function sandboxEvaluate(expr, context) {
+  return call("expr", expr, context, "expression");
+}
+function sandboxRunCode(source, context, filename) {
+  return call("code", source, context, filename);
+}
+
 // src/lib/flow-engine.ts
 var execAsync = promisify(exec);
 function sleep2(ms) {
@@ -2456,13 +2717,12 @@ function resolveValue(value, context) {
   }
   return value;
 }
-function evaluateExpression(expr, context) {
-  const fn = new Function("$", `return (${expr})`);
-  return fn(context);
+async function evaluateExpression(expr, context) {
+  return sandboxEvaluate(expr, context);
 }
-function evaluateCondition(expr, context) {
+async function evaluateCondition(expr, context) {
   try {
-    return Boolean(evaluateExpression(expr, context));
+    return Boolean(await evaluateExpression(expr, context));
   } catch (err) {
     if (err instanceof TypeError) return false;
     throw err;
@@ -2538,13 +2798,13 @@ function stepInterpolationSource(step) {
       return {};
   }
 }
-function dryResolveStep(step, context) {
+async function dryResolveStep(step, context) {
   const base = { stepId: step.id, name: step.name, type: step.type };
   const expr = step.type === "transform" ? step.transform?.expression : step.type === "condition" ? step.condition?.expression : step.type === "while" ? step.while?.condition : void 0;
   if (step.type === "transform" || step.type === "condition" || step.type === "while") {
     if (!expr) return { ...base, references: [] };
     try {
-      return { ...base, references: [], resolved: evaluateExpression(expr, context) };
+      return { ...base, references: [], resolved: await evaluateExpression(expr, context) };
     } catch (err) {
       if (err instanceof TypeError) {
         const deps = expressionDeferredOn(expr, context);
@@ -2577,57 +2837,23 @@ function dryResolveStep(step, context) {
   }
   return { ...base, references, resolved };
 }
-function dryResolveAllSteps(steps, context) {
+async function dryResolveAllSteps(steps, context) {
   const out = [];
-  const visit = (list) => {
+  const visit = async (list) => {
     for (const step of list) {
-      out.push(dryResolveStep(step, context));
+      out.push(await dryResolveStep(step, context));
       const config = step;
       for (const { configKey, fieldName } of getNestedStepsKeys()) {
         const block = config[configKey];
         if (block && Array.isArray(block[fieldName])) {
-          visit(block[fieldName]);
+          await visit(block[fieldName]);
         }
       }
     }
   };
-  visit(steps);
+  await visit(steps);
   return out;
 }
-var ALLOWED_MODULES = {
-  buffer: () => import("buffer"),
-  crypto: () => import("crypto"),
-  url: () => import("url"),
-  path: () => import("path")
-};
-var BLOCKED_MODULES = /* @__PURE__ */ new Set([
-  "fs",
-  "http",
-  "https",
-  "net",
-  "child_process",
-  "process",
-  "os",
-  "cluster",
-  "dgram",
-  "tls",
-  "vm",
-  "worker_threads"
-]);
-function createSandboxedRequire() {
-  const cache = {};
-  return async (moduleName) => {
-    const clean = moduleName.replace(/^node:/, "");
-    if (BLOCKED_MODULES.has(clean)) {
-      throw new Error(`Module "${moduleName}" is blocked in code steps`);
-    }
-    if (!ALLOWED_MODULES[clean]) {
-      throw new Error(`Module "${moduleName}" not available. Allowed: ${Object.keys(ALLOWED_MODULES).join(", ")}`);
-    }
-    if (!cache[clean]) cache[clean] = await ALLOWED_MODULES[clean]();
-    return cache[clean];
-  };
-}
 function stripCodeFences(text) {
   const trimmed = text.trim();
   const match = trimmed.match(/^```(?:\w*)\s*\n([\s\S]*?)\n\s*```\s*$/);
@@ -2637,9 +2863,9 @@ function stripToJson(text) {
   const s = stripCodeFences(text);
   const candidates = [s.indexOf("{"), s.indexOf("[")].filter((i) => i >= 0);
   if (candidates.length === 0) return s;
-  const start = Math.min(...candidates);
+  const start2 = Math.min(...candidates);
   const end = Math.max(s.lastIndexOf("}"), s.lastIndexOf("]"));
-  return end > start ? s.slice(start, end + 1) : s;
+  return end > start2 ? s.slice(start2, end + 1) : s;
 }
 function unwrapClaudeEnvelope(stdout, stepId) {
   const trimmed = stdout.trim();
@@ -2727,8 +2953,8 @@ async function executeActionStep(step, context, api, permissions, allowedActionI
     output: result.responseData
   };
 }
-function executeTransformStep(step, context) {
-  const output = evaluateExpression(step.transform.expression, context);
+async function executeTransformStep(step, context) {
+  const output = await evaluateExpression(step.transform.expression, context);
   return { status: "success", output, response: output };
 }
 async function executeCodeStep(step, context, options) {
@@ -2740,15 +2966,9 @@ async function executeCodeStep(step, context, options) {
   if (typeof config.source !== "string") {
     throw new Error(`Code step "${step.id}" must define either "source" or "module"`);
   }
-  const AsyncFunction = Object.getPrototypeOf(async function() {
-  }).constructor;
-  const sandboxedRequire = createSandboxedRequire();
   const sourceURL = `code:${step.id}`;
-  const taggedSource = `${config.source}
-//# sourceURL=${sourceURL}`;
-  const fn = new AsyncFunction("$", "require", taggedSource);
   try {
-    const output = await fn(context, sandboxedRequire);
+    const output = await sandboxRunCode(config.source, context, sourceURL);
     return { status: "success", output, response: output };
   } catch (err) {
     throw rewriteCodeStepError(err, step.id, config.source, sourceURL);
@@ -2780,6 +3000,9 @@ function rewriteCodeStepError(err, stepId, source, sourceURL) {
   return err;
 }
 async function executeCodeModule(stepId, modulePath, context, options) {
+  if (!options.allowCode) {
+    throw new Error(`Code step "${stepId}" runs module "${modulePath}" with full Node access and requires the --allow-code flag`);
+  }
   const rootDir = options.rootDir;
   if (!rootDir) {
     throw new Error(`Code step "${stepId}" uses module "${modulePath}" but no flow rootDir is available. Flows that use code modules must be loaded via loadFlowWithMeta.`);
@@ -2799,16 +3022,16 @@ async function executeCodeModule(stepId, modulePath, context, options) {
   void _omitEnv;
   const stdinPayload = JSON.stringify(safeContext);
   return await new Promise((resolve2, reject) => {
-    const child = spawn(process.execPath, [absPath], {
+    const child2 = spawn2(process.execPath, [absPath], {
       cwd: rootDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
     const stdoutChunks = [];
     const stderrChunks = [];
-    child.stdout.on("data", (c) => stdoutChunks.push(c));
-    child.stderr.on("data", (c) => stderrChunks.push(c));
-    child.on("error", (err) => reject(err));
-    child.on("close", (code) => {
+    child2.stdout.on("data", (c) => stdoutChunks.push(c));
+    child2.stderr.on("data", (c) => stderrChunks.push(c));
+    child2.on("error", (err) => reject(err));
+    child2.on("close", (code) => {
       const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
       const stderr = Buffer.concat(stderrChunks).toString("utf-8");
       if (code !== 0) {
@@ -2826,13 +3049,13 @@ async function executeCodeModule(stepId, modulePath, context, options) {
         reject(new Error(`Code module "${modulePath}" did not print valid JSON to stdout: ${err.message}`));
       }
     });
-    child.stdin.write(stdinPayload);
-    child.stdin.end();
+    child2.stdin.write(stdinPayload);
+    child2.stdin.end();
   });
 }
 async function executeConditionStep(step, context, api, permissions, allowedActionIds, options, flowStack) {
   const condition = step.condition;
-  const result = evaluateCondition(condition.expression, context);
+  const result = await evaluateCondition(condition.expression, context);
   const branch = result ? condition.then : condition.else || [];
   const branchResults = await executeSteps(branch, context, api, permissions, allowedActionIds, options, void 0, flowStack);
   return {
@@ -2975,7 +3198,7 @@ async function executeWhileStep(step, context, api, permissions, allowedActionId
   };
   for (let iteration = 0; iteration < maxIterations; iteration++) {
     if (iteration > 0) {
-      const conditionResult = evaluateCondition(config.condition, context);
+      const conditionResult = await evaluateCondition(config.condition, context);
       if (!conditionResult) break;
     }
     await executeSteps(config.steps, context, api, permissions, allowedActionIds, options, void 0, flowStack);
@@ -3000,7 +3223,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-6QTY3U2C.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-SRO6YL62.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -3197,7 +3420,7 @@ function checkRequires(step, context) {
 }
 async function executeSingleStep(step, context, api, permissions, allowedActionIds, options, flowStack = []) {
   if (step.if) {
-    const condResult = evaluateCondition(step.if, context);
+    const condResult = await evaluateCondition(step.if, context);
     if (!condResult) {
       const result = { status: "skipped" };
       context.steps[step.id] = result;
@@ -3205,7 +3428,7 @@ async function executeSingleStep(step, context, api, permissions, allowedActionI
     }
   }
   if (step.unless) {
-    const condResult = evaluateCondition(step.unless, context);
+    const condResult = await evaluateCondition(step.unless, context);
     if (condResult) {
       const result = { status: "skipped" };
       context.steps[step.id] = result;
@@ -3269,7 +3492,7 @@ async function executeSingleStep(step, context, api, permissions, allowedActionI
           case "action":
             return await executeActionStep(step, context, api, permissions, allowedActionIds, options);
           case "transform":
-            return executeTransformStep(step, context);
+            return await executeTransformStep(step, context);
           case "code":
             return await executeCodeStep(step, context, options);
           case "condition":
@@ -3366,7 +3589,7 @@ async function executeSteps(steps, context, api, permissions, allowedActionIds,
     if (isDryResolve && options.stopAfter === step.id) {
       options.onEvent?.({
         event: "step:dry-resolve",
-        ...dryResolveStep(step, context),
+        ...await dryResolveStep(step, context),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
       throw new FlowStopSignal(step.id);
@@ -3483,7 +3706,7 @@ async function executeFlow(flow, inputs, api, permissions, allowedActionIds, opt
       event: "flow:dry-run",
       flowKey: flow.key,
       resolvedInputs,
-      steps: dryResolveAllSteps(flow.steps, context),
+      steps: await dryResolveAllSteps(flow.steps, context),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
     return context;

package/dist/{chunk-WZTPSXHP.js → chunk-LEJKEGB6.js}

@@ -4,7 +4,7 @@ import {
 import {
   okJson,
   requireMemoryInit
-} from "./chunk-J7JWBH45.js";
+} from "./chunk-B5YDLVY5.js";
 import {
   isAgentMode,
   note
@@ -12,7 +12,7 @@ import {
 import {
   getBackend,
   upsertRecord
-} from "./chunk-6IRGRC3G.js";
+} from "./chunk-4H5L3SBY.js";
 
 // src/commands/mem/migrate.ts
 import fs4 from "fs";

package/dist/{chunk-DGQOAFXJ.js → chunk-TSMVFVQ3.js}

@@ -1,6 +1,6 @@
 import {
   requireMemoryInit
-} from "./chunk-J7JWBH45.js";
+} from "./chunk-B5YDLVY5.js";
 import {
   error,
   isAgentMode,
@@ -8,7 +8,7 @@ import {
 } from "./chunk-Q6PWTATS.js";
 import {
   getBackend
-} from "./chunk-6IRGRC3G.js";
+} from "./chunk-4H5L3SBY.js";
 
 // src/commands/mem/sql.ts
 async function memSqlCommand(sql) {