@withone/cli 2.13.0 → 2.14.1

package/README.md

@@ -610,14 +610,17 @@ Press Ctrl+C during execution to pause - the run can be resumed later with `one
 | Option | What it does |
 |--------|-------------|
 | `-i, --input <name=value>` | Input parameter (repeatable) |
-| `--dry-run` | Resolve each step's interpolations and show what they evaluate to, without executing any step. `$.input.*`/`$.env.*` resolve up front; `$.steps.*` refs are reported as deferred (they're produced at runtime). |
+| `--dry-run` | Resolve each step's interpolations and show what they evaluate to, without running actions, code, bash or file steps. Transform and condition expressions are evaluated, in the sandbox. `$.input.*`/`$.env.*` resolve up front; `$.steps.*` refs are reported as deferred (they're produced at runtime). |
 | `--mock` | With `--dry-run`: execute transforms/code with realistic mock API responses |
 | `--stop-after <stepId>` | Execute steps up to and including `<stepId>`, then stop (later steps are not run). Combined with `--dry-run`, runs earlier steps for real and dry-resolves `<stepId>` against their output without executing it. Inspect what ran with `one flow inspect <runId>`. |
 | `--skip-validation` | Skip input validation against action schemas |
 | `--allow-bash` | Allow bash step execution (disabled by default for security) |
+| `--allow-code` | Allow `code.module` steps, which run a `.mjs` file with full Node access (disabled by default for security) |
 | `-v, --verbose` | Show full request/response for each step |
 | `--output-file <path>` | Stream the full result to a file instead of stdout — for large results that would otherwise be truncated or exceed the JSON string-size limit. stdout (and `--agent` output) then carries an `outputFile` pointer instead of inline `steps`. |
 
+Inline JavaScript in a flow (transforms, conditions, `if`/`unless`, `code.source`) runs in a sandbox: a separate Node process with no file, child-process or network access and no environment of its own. It needs no flag. `code.module` steps are full Node programs and need `--allow-code`.
+
 Step-level `if`/`unless` conditions (and `while`/`condition` steps) are null-safe: a condition that references a skipped or not-yet-run step's output (e.g. `$.steps.maybeSkipped.output.x`) evaluates to `false` rather than crashing the run.
 
 ### `one flow list`
@@ -643,9 +646,10 @@ Resume a paused or failed workflow run from where it left off.
 ```bash
 one flow resume abc123
 one flow resume abc123 --allow-bash    # required if the flow has bash steps
+one flow resume abc123 --allow-code    # required if the flow has code.module steps
 ```
 
-`--allow-bash` is gated the same way as on `flow execute` — resuming doesn't
+`--allow-bash` and `--allow-code` are gated the same way as on `flow execute` — resuming doesn't
 inherit the permission from the original run, so pass it again. `one flow list`
 shows which flows need it.
 

package/dist/{chunk-UZC3IHLW.js → chunk-IM3OA7CU.js}

@@ -40,7 +40,7 @@ import crypto from "crypto";
 import fs4 from "fs";
 import os2 from "os";
 import path5 from "path";
-import { exec, spawn } from "child_process";
+import { exec, spawn as spawn2 } from "child_process";
 import { promisify } from "util";
 
 // src/lib/install-context.ts
@@ -1506,8 +1506,8 @@ var FLOW_SCHEMA = {
       configKey: "code",
       description: "JS code \u2014 inline source or an external .mjs module under the flow's lib/ folder",
       fields: {
-        source: { type: "string", required: false, description: 'Inline JS function body (flow context as $, supports await). Mutually exclusive with "module".' },
-        module: { type: "string", required: false, description: 'Relative path to a .mjs file under the flow folder (e.g. "lib/normalize.mjs"). Reads $ from stdin as JSON, writes result to stdout as JSON. Mutually exclusive with "source".' }
+        source: { type: "string", required: false, description: 'Inline JS function body (flow context as $, supports await). Runs in the sandbox: no files, programs, network or timers. Mutually exclusive with "module".' },
+        module: { type: "string", required: false, description: 'Relative path to a .mjs file under the flow folder (e.g. "lib/normalize.mjs"). Reads $ from stdin as JSON, writes result to stdout as JSON. Mutually exclusive with "source". Runs with full Node access and requires --allow-code.' }
       },
       example: {
         id: "processData",
@@ -1735,7 +1735,7 @@ function generateFlowGuide() {
 Workflows live in \`.one/flows/\` (relative to your current working directory \u2014 the CLI does NOT walk up parent directories or fall back to a global location) and chain actions across platforms. Two layouts are supported:
 
 - **Folder layout (REQUIRED for new flows)** \u2014 \`.one/flows/<key>/flow.json\`, with an optional \`lib/\` subfolder for JavaScript modules. This is like a skill: the folder groups the JSON spec with any JavaScript modules it needs, so the whole flow is shareable. **Always create new flows in this layout.**
-- **Single-file layout (DEPRECATED)** \u2014 \`.one/flows/<key>.flow.json\`. Still loads and runs for backward compatibility, but is deprecated. Do not create new flows in this layout. When editing an existing single-file flow, migrate it to the folder layout: move \`<key>.flow.json\` to \`<key>/flow.json\` and extract any non-trivial \`code.source\` blocks into \`<key>/lib/*.mjs\` modules.
+- **Single-file layout (DEPRECATED)** \u2014 \`.one/flows/<key>.flow.json\`. Still loads and runs for backward compatibility, but is deprecated. Do not create new flows in this layout. When editing an existing single-file flow, migrate it to the folder layout: move \`<key>.flow.json\` to \`<key>/flow.json\`. Move a \`code.source\` block into a \`<key>/lib/*.mjs\` module only if it needs files, network or timers: modules run with full Node access and make the flow require \`--allow-code\`.
 
 **Subdirectory groups** \u2014 Flows can be organized into subdirectories: \`.one/flows/<group>/<key>/flow.json\`. For example:
 \`\`\`
@@ -1755,16 +1755,17 @@ When resolving a flow by key, the CLI checks the folder layout first, then the d
 **Agents: always inspect a flow before running it.** Nothing about a flow's runtime requirements is guessable from its name. Before \`flow execute\`, do one of these:
 
 1. Run \`one --agent flow list\` \u2014 the JSON output includes \`requiresBash\`, \`usesCodeModules\`, \`inputs\` (with \`autoResolvable\` flags), \`stepTypes\`, and the flow's \`description\`. This is the fastest path.
-2. Read the flow's \`description\` field directly from the JSON. Flow authors are required (see "Author conventions" below) to state any \`--allow-bash\` requirement and any non-auto-resolving inputs in the description.
+2. Read the flow's \`description\` field directly from the JSON. Flow authors are required (see "Author conventions" below) to state any \`--allow-bash\` or \`--allow-code\` requirement and any non-auto-resolving inputs in the description.
 3. Run \`one --agent flow execute <key> --dry-run\` to see the resolved inputs and step plan without side effects.
 
-If you skip this step you will hit errors like *"Workflow X contains bash steps. Re-run with --allow-bash."* \u2014 the CLI now pre-flights and fails fast, so you won't waste a long run, but the error is still avoidable by reading first.
+If you skip this step you will hit errors like *"Workflow X contains bash steps. Re-run with --allow-bash."* (or the same for \`code.module\` steps and \`--allow-code\`) \u2014 the CLI now pre-flights and fails fast, so you won't waste a long run, but the error is still avoidable by reading first.
 
 ## Author conventions \u2014 WRITE flows that are safe to execute blind
 
 When you create a flow, its \`description\` field is the contract with future executors (human or agent). It MUST state:
 
 - **\`--allow-bash\` if any step is type \`bash\`.** Example: *"Fetches recent Gmail threads and summarizes them with Claude Haiku. Requires \`--allow-bash\`."*
+- **\`--allow-code\` if any code step uses \`code.module\`.** Modules run with full Node access, so they are gated like bash.
 - **Every input that does NOT have a \`connection\` hint.** Connection inputs auto-resolve when exactly one matching connection exists; everything else must be passed via \`-i name=value\` and the description must name it.
 - **Any files/directories the flow writes to** so operators know what will be modified on disk.
 
@@ -1782,6 +1783,7 @@ one --agent flow execute <key> -i name=value                     # Execute (bare
 one --agent flow execute <group/key> -i name=value               # Execute (namespaced key)
 one --agent flow execute <key> --dry-run --mock                  # Test with mock data
 one --agent flow execute <key> --allow-bash                      # Enable bash steps
+one --agent flow execute <key> --allow-code                      # Enable code.module steps (full Node)
 one --agent flow runs [flowKey]                                  # List past runs
 one --agent flow resume <runId>                                  # Resume failed run
 one --agent flow scaffold [template]                             # Generate a starter template
@@ -1828,7 +1830,7 @@ If you're editing an existing \`.one/flows/<key>.flow.json\`, migrate it \u2014
 
 1. \`mkdir -p .one/flows/<key>/lib\`
 2. Move the file: \`mv .one/flows/<key>.flow.json .one/flows/<key>/flow.json\`
-3. For each non-trivial \`code\` step with inline \`source\`, extract it into \`lib/<step-id>.mjs\` (see translation pattern below) and swap the step config from \`{ "source": "..." }\` to \`{ "module": "lib/<step-id>.mjs" }\`. One-liners can stay inline.
+3. Leave inline \`code.source\` in place unless it needs files, network or timers; it runs in the sandbox and needs no flag. If it does need them, extract it into \`lib/<step-id>.mjs\` (see translation pattern below) and swap the step config to \`{ "module": "lib/<step-id>.mjs" }\`. That gives it full Node access and makes the flow require \`--allow-code\`.
 4. Validate: \`one --agent flow validate <key>\`.
 5. Run it and confirm behavior is unchanged.
 
@@ -2196,13 +2198,272 @@ Set timeout to at least 180000ms (3 min). Run Claude-heavy flows sequentially, n
 
 - Connection keys are **inputs**, not hardcoded
 - Action IDs in examples are placeholders \u2014 always use \`actions find\`
-- Inline \`code.source\` steps allow \`require('crypto' | 'buffer' | 'url' | 'path')\` \u2014 \`fs\`, \`http\`, \`child_process\` are blocked
-- For anything beyond one-liners, use \`code.module\` to point at a \`.mjs\` file in the flow's \`lib/\` folder \u2014 runs as a child \`node\` process with full Node APIs, reads \`$\` from stdin, writes JSON to stdout
+- Transforms, conditions, \`if\`/\`unless\` and inline \`code.source\` run in a sandbox (separate process, no files, programs, network or environment of its own). \`code.source\` allows \`require('crypto' | 'buffer' | 'url' | 'path')\` \u2014 \`fs\`, \`http\`, \`child_process\` are blocked. \`$\` is a copy: return a value, don't mutate \`$\`
+- When a step needs files, network or timers, use \`code.module\` to point at a \`.mjs\` file in the flow's \`lib/\` folder \u2014 runs as a child \`node\` process with full Node APIs, reads \`$\` from stdin, writes JSON to stdout. Requires \`--allow-code\`
 - Bash steps require \`--allow-bash\` flag
 - State is persisted after every step \u2014 resume picks up where it left off`);
   return sections.join("\n");
 }
 
+// src/lib/flow-sandbox.ts
+import { spawn } from "child_process";
+var syncTimeoutMs = 3e4;
+var callTimeoutMs = 6e4;
+var SANDBOX_NODE_FLAGS = ["--permission", "--disallow-code-generation-from-strings"];
+function sandboxEnv() {
+  if (process.platform === "win32" && process.env.SystemRoot) return { SystemRoot: process.env.SystemRoot };
+  return {};
+}
+var BOOTSTRAP = String.raw`
+'use strict';
+const vm = require('node:vm');
+const proc = process;
+const MODULES = {
+  buffer: require('node:buffer'),
+  crypto: require('node:crypto'),
+  url: require('node:url'),
+  path: require('node:path'),
+};
+const BLOCKED = new Set(['fs', 'http', 'https', 'net', 'child_process', 'process', 'os',
+  'cluster', 'dgram', 'tls', 'vm', 'worker_threads']);
+const sandboxRequire = async (name) => {
+  const clean = String(name).replace(/^node:/, '');
+  if (BLOCKED.has(clean)) throw new Error('Module "' + name + '" is blocked in code steps');
+  if (!Object.prototype.hasOwnProperty.call(MODULES, clean)) {
+    throw new Error('Module "' + name + '" not available. Allowed: ' + Object.keys(MODULES).join(', '));
+  }
+  return MODULES[clean];
+};
+const SYNC_TIMEOUT = Number(proc.argv[proc.argv.length - 1]) || 30000;
+const send = proc.send.bind(proc);
+
+for (const k of ['process', 'require', 'module', 'exports', '__filename', '__dirname',
+  'fetch', 'WebSocket', 'EventSource', 'Request', 'Response', 'Headers', 'FormData',
+  'setTimeout', 'setInterval', 'setImmediate', 'clearTimeout', 'clearInterval',
+  'clearImmediate', 'navigator', 'global']) {
+  try { delete globalThis[k]; } catch (_) { /* non-configurable: leave it */ }
+}
+
+const describe = (err) => {
+  if (err && typeof err === 'object') {
+    return { name: String(err.name || 'Error'), message: String(err.message), stack: String(err.stack || '') };
+  }
+  return { name: 'Error', message: String(err), stack: '' };
+};
+
+const reply = (id, value) => {
+  try {
+    send({ id, ok: true, value });
+  } catch (err) {
+    send({ id, ok: false, error: { name: 'Error', stack: '', message:
+      'returned a value that cannot be copied out of the sandbox (functions, symbols and class instances with private state cannot be passed between steps): ' + (err && err.message) } });
+  }
+};
+
+// The sandbox's copy of $. The host sends only the parts that changed since
+// the last call (see syncFor in flow-sandbox.ts), so a loop over a large
+// step output doesn't copy that output again on every iteration.
+let store = { input: {}, env: {}, steps: {}, loop: {} };
+const applySync = (sync) => {
+  if (sync.reset) store = { input: {}, env: {}, steps: {}, loop: {} };
+  if ('input' in sync) store.input = sync.input;
+  if ('env' in sync) store.env = sync.env;
+  if ('loop' in sync) store.loop = sync.loop;
+  if (sync.steps) for (const k of Object.keys(sync.steps)) store.steps[k] = sync.steps[k];
+  if (sync.drop) for (const k of sync.drop) delete store.steps[k];
+};
+
+proc.on('message', async (msg) => {
+  const { id, kind, code, sync, filename } = msg;
+  try {
+    applySync(sync);
+    globalThis.__one_ctx = store;
+    globalThis.__one_require = sandboxRequire;
+    let value;
+    if (kind === 'expr') {
+      const script = new vm.Script('(function ($) { return (' + code + '\n) })(__one_ctx)', { filename: filename || 'expression' });
+      value = script.runInThisContext({ timeout: SYNC_TIMEOUT });
+    } else {
+      // Same wrapper shape as new AsyncFunction('$', 'require', body), so
+      // stack line numbers are offset by exactly 2, as the engine expects.
+      const script = new vm.Script('(async function anonymous($,require\n) {\n' + code + '\n})(__one_ctx, __one_require)', { filename });
+      value = await script.runInThisContext({ timeout: SYNC_TIMEOUT });
+    }
+    reply(id, value);
+  } catch (err) {
+    send({ id, ok: false, error: describe(err) });
+  } finally {
+    delete globalThis.__one_ctx;
+    delete globalThis.__one_require;
+  }
+});
+send({ ready: true });
+`;
+var child = null;
+var ready = null;
+var nextId = 1;
+var pending2 = /* @__PURE__ */ new Map();
+var ERROR_CTORS = {
+  TypeError,
+  SyntaxError,
+  ReferenceError,
+  RangeError,
+  EvalError,
+  URIError
+};
+function rebuildError(e) {
+  const Ctor = ERROR_CTORS[e.name] ?? Error;
+  const err = new Ctor(e.message);
+  if (!ERROR_CTORS[e.name] && e.name && e.name !== "Error") err.name = e.name;
+  if (e.stack) err.stack = e.stack;
+  return err;
+}
+function setRef(on) {
+  if (!child) return;
+  const channel = child.channel;
+  if (on) {
+    child.ref();
+    channel?.ref();
+  } else {
+    child.unref();
+    channel?.unref();
+  }
+}
+function failAll(proc, err) {
+  for (const [id, p] of pending2) {
+    if (p.proc !== proc) continue;
+    clearTimeout(p.timer);
+    pending2.delete(id);
+    p.reject(err);
+  }
+}
+function start() {
+  if (ready) return ready;
+  const proc = spawn(
+    process.execPath,
+    [...SANDBOX_NODE_FLAGS, "-e", BOOTSTRAP, "--", String(syncTimeoutMs)],
+    {
+      stdio: ["ignore", "inherit", "inherit", "ipc"],
+      serialization: "advanced",
+      env: sandboxEnv(),
+      windowsHide: true
+    }
+  );
+  child = proc;
+  ready = new Promise((resolve2, reject) => {
+    const onReady = (msg) => {
+      if (msg && typeof msg === "object" && msg.ready) {
+        proc.off("message", onReady);
+        resolve2();
+      }
+    };
+    proc.on("message", onReady);
+    proc.once("error", (err) => reject(new Error(`Could not start the flow code sandbox: ${err.message}`)));
+    proc.once("exit", (code, signal) => {
+      reject(new Error(`Flow code sandbox exited before it was ready (code ${code}, signal ${signal})`));
+    });
+  });
+  proc.on("message", (msg) => {
+    if (typeof msg?.id !== "number") return;
+    const p = pending2.get(msg.id);
+    if (!p) return;
+    clearTimeout(p.timer);
+    pending2.delete(msg.id);
+    if (pending2.size === 0) setRef(false);
+    if (msg.ok) p.resolve(msg.value);
+    else p.reject(rebuildError(msg.error ?? { name: "Error", message: "unknown sandbox error", stack: "" }));
+  });
+  proc.on("exit", (code, signal) => {
+    if (child === proc) {
+      child = null;
+      ready = null;
+    }
+    failAll(proc, new Error(`Flow code sandbox stopped (code ${code}, signal ${signal})`));
+  });
+  proc.on("error", (err) => {
+    if (child === proc) {
+      child = null;
+      ready = null;
+    }
+    failAll(proc, err);
+  });
+  return ready;
+}
+var synced = null;
+function syncFor(proc, context) {
+  const prev = synced && synced.proc === proc && synced.context === context && synced.stepsObj === context.steps ? synced : null;
+  const sync = {};
+  if (!prev) sync.reset = true;
+  if (!prev || prev.input !== context.input) sync.input = context.input;
+  if (!prev || prev.env !== context.env) sync.env = context.env;
+  if (!prev || prev.loop !== context.loop) sync.loop = context.loop;
+  const stepUpdates = {};
+  let anyStep = false;
+  const nextSteps = /* @__PURE__ */ new Map();
+  for (const [k, v] of Object.entries(context.steps)) {
+    nextSteps.set(k, v);
+    if (!prev || prev.steps.get(k) !== v) {
+      stepUpdates[k] = v;
+      anyStep = true;
+    }
+  }
+  if (anyStep) sync.steps = stepUpdates;
+  if (prev) {
+    const drop = [...prev.steps.keys()].filter((k) => !nextSteps.has(k));
+    if (drop.length) sync.drop = drop;
+  }
+  const commit = () => {
+    synced = {
+      proc,
+      context,
+      stepsObj: context.steps,
+      input: context.input,
+      env: context.env,
+      loop: context.loop,
+      steps: nextSteps
+    };
+  };
+  return { sync, commit };
+}
+async function call(kind, code, context, filename) {
+  await start();
+  const proc = child;
+  const id = nextId++;
+  return new Promise((resolve2, reject) => {
+    const timer = setTimeout(() => {
+      pending2.delete(id);
+      reject(new Error(`timed out after ${callTimeoutMs / 1e3}s`));
+      if (child === proc) {
+        child = null;
+        ready = null;
+      }
+      proc.kill();
+    }, callTimeoutMs);
+    timer.unref();
+    pending2.set(id, { resolve: resolve2, reject, timer, proc });
+    setRef(true);
+    const { sync, commit } = syncFor(proc, context);
+    try {
+      proc.send({ id, kind, code, sync, filename });
+      commit();
+    } catch (err) {
+      synced = null;
+      clearTimeout(timer);
+      pending2.delete(id);
+      if (pending2.size === 0) setRef(false);
+      reject(new Error(
+        `the flow context contains a value that cannot be passed to the sandbox: ${err.message}`
+      ));
+    }
+  });
+}
+function sandboxEvaluate(expr, context) {
+  return call("expr", expr, context, "expression");
+}
+function sandboxRunCode(source, context, filename) {
+  return call("code", source, context, filename);
+}
+
 // src/lib/flow-engine.ts
 var execAsync = promisify(exec);
 function sleep2(ms) {
@@ -2456,13 +2717,12 @@ function resolveValue(value, context) {
   }
   return value;
 }
-function evaluateExpression(expr, context) {
-  const fn = new Function("$", `return (${expr})`);
-  return fn(context);
+async function evaluateExpression(expr, context) {
+  return sandboxEvaluate(expr, context);
 }
-function evaluateCondition(expr, context) {
+async function evaluateCondition(expr, context) {
   try {
-    return Boolean(evaluateExpression(expr, context));
+    return Boolean(await evaluateExpression(expr, context));
   } catch (err) {
     if (err instanceof TypeError) return false;
     throw err;
@@ -2538,13 +2798,13 @@ function stepInterpolationSource(step) {
       return {};
   }
 }
-function dryResolveStep(step, context) {
+async function dryResolveStep(step, context) {
   const base = { stepId: step.id, name: step.name, type: step.type };
   const expr = step.type === "transform" ? step.transform?.expression : step.type === "condition" ? step.condition?.expression : step.type === "while" ? step.while?.condition : void 0;
   if (step.type === "transform" || step.type === "condition" || step.type === "while") {
     if (!expr) return { ...base, references: [] };
     try {
-      return { ...base, references: [], resolved: evaluateExpression(expr, context) };
+      return { ...base, references: [], resolved: await evaluateExpression(expr, context) };
     } catch (err) {
       if (err instanceof TypeError) {
         const deps = expressionDeferredOn(expr, context);
@@ -2577,57 +2837,23 @@ function dryResolveStep(step, context) {
   }
   return { ...base, references, resolved };
 }
-function dryResolveAllSteps(steps, context) {
+async function dryResolveAllSteps(steps, context) {
   const out = [];
-  const visit = (list) => {
+  const visit = async (list) => {
     for (const step of list) {
-      out.push(dryResolveStep(step, context));
+      out.push(await dryResolveStep(step, context));
       const config = step;
       for (const { configKey, fieldName } of getNestedStepsKeys()) {
         const block = config[configKey];
         if (block && Array.isArray(block[fieldName])) {
-          visit(block[fieldName]);
+          await visit(block[fieldName]);
         }
       }
     }
   };
-  visit(steps);
+  await visit(steps);
   return out;
 }
-var ALLOWED_MODULES = {
-  buffer: () => import("buffer"),
-  crypto: () => import("crypto"),
-  url: () => import("url"),
-  path: () => import("path")
-};
-var BLOCKED_MODULES = /* @__PURE__ */ new Set([
-  "fs",
-  "http",
-  "https",
-  "net",
-  "child_process",
-  "process",
-  "os",
-  "cluster",
-  "dgram",
-  "tls",
-  "vm",
-  "worker_threads"
-]);
-function createSandboxedRequire() {
-  const cache = {};
-  return async (moduleName) => {
-    const clean = moduleName.replace(/^node:/, "");
-    if (BLOCKED_MODULES.has(clean)) {
-      throw new Error(`Module "${moduleName}" is blocked in code steps`);
-    }
-    if (!ALLOWED_MODULES[clean]) {
-      throw new Error(`Module "${moduleName}" not available. Allowed: ${Object.keys(ALLOWED_MODULES).join(", ")}`);
-    }
-    if (!cache[clean]) cache[clean] = await ALLOWED_MODULES[clean]();
-    return cache[clean];
-  };
-}
 function stripCodeFences(text) {
   const trimmed = text.trim();
   const match = trimmed.match(/^```(?:\w*)\s*\n([\s\S]*?)\n\s*```\s*$/);
@@ -2637,9 +2863,9 @@ function stripToJson(text) {
   const s = stripCodeFences(text);
   const candidates = [s.indexOf("{"), s.indexOf("[")].filter((i) => i >= 0);
   if (candidates.length === 0) return s;
-  const start = Math.min(...candidates);
+  const start2 = Math.min(...candidates);
   const end = Math.max(s.lastIndexOf("}"), s.lastIndexOf("]"));
-  return end > start ? s.slice(start, end + 1) : s;
+  return end > start2 ? s.slice(start2, end + 1) : s;
 }
 function unwrapClaudeEnvelope(stdout, stepId) {
   const trimmed = stdout.trim();
@@ -2727,8 +2953,8 @@ async function executeActionStep(step, context, api, permissions, allowedActionI
     output: result.responseData
   };
 }
-function executeTransformStep(step, context) {
-  const output = evaluateExpression(step.transform.expression, context);
+async function executeTransformStep(step, context) {
+  const output = await evaluateExpression(step.transform.expression, context);
   return { status: "success", output, response: output };
 }
 async function executeCodeStep(step, context, options) {
@@ -2740,15 +2966,9 @@ async function executeCodeStep(step, context, options) {
   if (typeof config.source !== "string") {
     throw new Error(`Code step "${step.id}" must define either "source" or "module"`);
   }
-  const AsyncFunction = Object.getPrototypeOf(async function() {
-  }).constructor;
-  const sandboxedRequire = createSandboxedRequire();
   const sourceURL = `code:${step.id}`;
-  const taggedSource = `${config.source}
-//# sourceURL=${sourceURL}`;
-  const fn = new AsyncFunction("$", "require", taggedSource);
   try {
-    const output = await fn(context, sandboxedRequire);
+    const output = await sandboxRunCode(config.source, context, sourceURL);
     return { status: "success", output, response: output };
   } catch (err) {
     throw rewriteCodeStepError(err, step.id, config.source, sourceURL);
@@ -2780,6 +3000,9 @@ function rewriteCodeStepError(err, stepId, source, sourceURL) {
   return err;
 }
 async function executeCodeModule(stepId, modulePath, context, options) {
+  if (!options.allowCode) {
+    throw new Error(`Code step "${stepId}" runs module "${modulePath}" with full Node access and requires the --allow-code flag`);
+  }
   const rootDir = options.rootDir;
   if (!rootDir) {
     throw new Error(`Code step "${stepId}" uses module "${modulePath}" but no flow rootDir is available. Flows that use code modules must be loaded via loadFlowWithMeta.`);
@@ -2799,16 +3022,16 @@ async function executeCodeModule(stepId, modulePath, context, options) {
   void _omitEnv;
   const stdinPayload = JSON.stringify(safeContext);
   return await new Promise((resolve2, reject) => {
-    const child = spawn(process.execPath, [absPath], {
+    const child2 = spawn2(process.execPath, [absPath], {
       cwd: rootDir,
       stdio: ["pipe", "pipe", "pipe"]
     });
     const stdoutChunks = [];
     const stderrChunks = [];
-    child.stdout.on("data", (c) => stdoutChunks.push(c));
-    child.stderr.on("data", (c) => stderrChunks.push(c));
-    child.on("error", (err) => reject(err));
-    child.on("close", (code) => {
+    child2.stdout.on("data", (c) => stdoutChunks.push(c));
+    child2.stderr.on("data", (c) => stderrChunks.push(c));
+    child2.on("error", (err) => reject(err));
+    child2.on("close", (code) => {
       const stdout = Buffer.concat(stdoutChunks).toString("utf-8");
       const stderr = Buffer.concat(stderrChunks).toString("utf-8");
       if (code !== 0) {
@@ -2826,13 +3049,13 @@ async function executeCodeModule(stepId, modulePath, context, options) {
         reject(new Error(`Code module "${modulePath}" did not print valid JSON to stdout: ${err.message}`));
       }
     });
-    child.stdin.write(stdinPayload);
-    child.stdin.end();
+    child2.stdin.write(stdinPayload);
+    child2.stdin.end();
   });
 }
 async function executeConditionStep(step, context, api, permissions, allowedActionIds, options, flowStack) {
   const condition = step.condition;
-  const result = evaluateCondition(condition.expression, context);
+  const result = await evaluateCondition(condition.expression, context);
   const branch = result ? condition.then : condition.else || [];
   const branchResults = await executeSteps(branch, context, api, permissions, allowedActionIds, options, void 0, flowStack);
   return {
@@ -2975,7 +3198,7 @@ async function executeWhileStep(step, context, api, permissions, allowedActionId
   };
   for (let iteration = 0; iteration < maxIterations; iteration++) {
     if (iteration > 0) {
-      const conditionResult = evaluateCondition(config.condition, context);
+      const conditionResult = await evaluateCondition(config.condition, context);
       if (!conditionResult) break;
     }
     await executeSteps(config.steps, context, api, permissions, allowedActionIds, options, void 0, flowStack);
@@ -3000,7 +3223,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-Y4DW3UD3.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-SRO6YL62.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -3197,7 +3420,7 @@ function checkRequires(step, context) {
 }
 async function executeSingleStep(step, context, api, permissions, allowedActionIds, options, flowStack = []) {
   if (step.if) {
-    const condResult = evaluateCondition(step.if, context);
+    const condResult = await evaluateCondition(step.if, context);
     if (!condResult) {
       const result = { status: "skipped" };
       context.steps[step.id] = result;
@@ -3205,7 +3428,7 @@ async function executeSingleStep(step, context, api, permissions, allowedActionI
     }
   }
   if (step.unless) {
-    const condResult = evaluateCondition(step.unless, context);
+    const condResult = await evaluateCondition(step.unless, context);
     if (condResult) {
       const result = { status: "skipped" };
       context.steps[step.id] = result;
@@ -3269,7 +3492,7 @@ async function executeSingleStep(step, context, api, permissions, allowedActionI
           case "action":
             return await executeActionStep(step, context, api, permissions, allowedActionIds, options);
           case "transform":
-            return executeTransformStep(step, context);
+            return await executeTransformStep(step, context);
           case "code":
             return await executeCodeStep(step, context, options);
           case "condition":
@@ -3366,7 +3589,7 @@ async function executeSteps(steps, context, api, permissions, allowedActionIds,
     if (isDryResolve && options.stopAfter === step.id) {
       options.onEvent?.({
         event: "step:dry-resolve",
-        ...dryResolveStep(step, context),
+        ...await dryResolveStep(step, context),
         timestamp: (/* @__PURE__ */ new Date()).toISOString()
       });
       throw new FlowStopSignal(step.id);
@@ -3483,7 +3706,7 @@ async function executeFlow(flow, inputs, api, permissions, allowedActionIds, opt
       event: "flow:dry-run",
       flowKey: flow.key,
       resolvedInputs,
-      steps: dryResolveAllSteps(flow.steps, context),
+      steps: await dryResolveAllSteps(flow.steps, context),
       timestamp: (/* @__PURE__ */ new Date()).toISOString()
     });
     return context;

package/dist/{flow-runner-Y4DW3UD3.js → flow-runner-SRO6YL62.js}

@@ -12,7 +12,7 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-UZC3IHLW.js";
+} from "./chunk-IM3OA7CU.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-Q6PWTATS.js";
 import "./chunk-XUAUDMQE.js";

package/dist/index.js

@@ -14,6 +14,7 @@ import {
   describeInstallContext,
   drainQueue,
   flowRequiresBash,
+  flowUsesCodeModules,
   flush,
   flushUsageRollups,
   formatAge,
@@ -39,7 +40,7 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-UZC3IHLW.js";
+} from "./chunk-IM3OA7CU.js";
 import {
   memSqlCommand
 } from "./chunk-TSMVFVQ3.js";
@@ -4957,6 +4958,14 @@ ${preflightErrors.map((e) => `  ${e.path}: ${e.message}`).join("\n")}`);
     }
     error(msg);
   }
+  if (!options.allowCode && flowUsesCodeModules(flow2)) {
+    const msg = `Workflow "${flow2.key}" contains code.module steps, which run with full Node access. Re-run with --allow-code to permit them.`;
+    if (isAgentMode()) {
+      json({ error: msg, requiresCode: true, flowKey: flow2.key });
+      process.exit(1);
+    }
+    error(msg);
+  }
   if (options.stopAfter) {
     const ids = /* @__PURE__ */ new Set();
     walkSteps(flow2.steps, (s) => {
@@ -5019,6 +5028,7 @@ ${pc8.yellow("Pausing after current step completes...")} (run ID: ${runId})`);
       mock: options.mock,
       verbose: options.verbose,
       allowBash: options.allowBash,
+      allowCode: options.allowCode,
       skipValidation: options.skipValidation,
       stopAfter: options.stopAfter,
       rootDir,
@@ -5129,7 +5139,7 @@ async function flowListCommand() {
       layout: f.layout,
       inputCount: String(f.inputCount),
       stepCount: String(f.stepCount),
-      flags: f.requiresBash ? "--allow-bash" : ""
+      flags: [f.requiresBash ? "--allow-bash" : "", f.usesCodeModules ? "--allow-code" : ""].filter(Boolean).join(" ")
     }))
   );
   console.log();
@@ -5205,6 +5215,14 @@ async function flowResumeCommand(runId, options = {}) {
     }
     error(msg);
   }
+  if (!options.allowCode && flowUsesCodeModules(flow2)) {
+    const msg = `Workflow "${flow2.key}" contains code.module steps, which run with full Node access. Re-run with --allow-code to permit them.`;
+    if (isAgentMode()) {
+      json({ error: msg, requiresCode: true, flowKey: flow2.key, runId });
+      process.exit(1);
+    }
+    error(msg);
+  }
   const runner = FlowRunner.fromRunState(state);
   const onEvent = (event) => {
     if (isAgentMode()) {
@@ -5217,7 +5235,8 @@ async function flowResumeCommand(runId, options = {}) {
     const context = await runner.resume(flow2, api, permissions, actionIds, {
       onEvent,
       rootDir,
-      allowBash: options.allowBash
+      allowBash: options.allowBash,
+      allowCode: options.allowCode
     });
     spinner.stop("Workflow completed");
     if (isAgentMode()) {
@@ -11436,15 +11455,16 @@ one --agent flow list                                 # List all workflows
 
 **Key concepts:**
 - Workflows live at \`.one/flows/<key>/flow.json\` (folder layout \u2014 REQUIRED for new flows). Flows can be organized into subdirectory groups: \`.one/flows/<group>/<key>/flow.json\`. Reference them as \`group/key\` or just the bare key. The legacy \`.one/flows/<key>.flow.json\` single-file layout is DEPRECATED but still loads for backward compatibility
-- Code steps can reference an external \`.mjs\` module under the flow's \`lib/\` folder (stdin JSON in, stdout JSON out) \u2014 keeps JS out of JSON strings and makes flows shareable
+- Code steps can reference an external \`.mjs\` module under the flow's \`lib/\` folder (stdin JSON in, stdout JSON out). Modules have full Node access, so flows that use them need \`--allow-code\`
+- Inline JavaScript (transforms, conditions, \`if\`/\`unless\`, \`code.source\`) runs in a sandbox: no files, programs, network, timers or environment of its own, and no flag needed
 - 12 step types: action, transform, code, condition, loop, parallel, file-read, file-write, while, flow, paginate, bash
 - Data wiring via selectors: \`$.input.param\`, \`$.steps.stepId.response\`, \`$.loop.item\`
 - AI analysis via bash steps: \`claude --print --output-format json\` with \`parseEnvelope: true\` (unwraps the CLI envelope + fences + preamble into clean parsed JSON; use instead of \`parseJson\` for claude steps)
-- Use \`--allow-bash\` to enable bash steps, \`--mock\` for dry-run with realistic mock responses (uses example data from action schemas)
+- Use \`--allow-bash\` to enable bash steps, \`--allow-code\` to enable \`code.module\` steps, \`--mock\` for dry-run with realistic mock responses (uses example data from action schemas)
 - Use \`--skip-validation\` to bypass input validation on action steps
 - Use \`--output-file <path>\` to stream the full result to a file instead of stdout \u2014 for large results that would otherwise be truncated or hit the JSON string-size limit; stdout (and \`--agent\` output) then carries an \`outputFile\` pointer instead of inline \`steps\`
 - Step-level \`if\`/\`unless\` (and \`while\`/\`condition\` steps) are null-safe: a condition referencing a skipped or not-yet-run step's output (e.g. \`$.steps.maybeSkipped.output.x\`) evaluates to \`false\` instead of crashing the flow
-- Debugging: \`--dry-run\` resolves each step's interpolations and shows what they evaluate to without executing (\`$.steps.*\` refs are reported as deferred); \`--stop-after <stepId>\` runs up to a step then stops; \`--dry-run --stop-after <stepId>\` runs earlier steps for real then dry-resolves the target against their output; \`flow inspect <runId>\` shows a past run's per-step outputs (post-mortem, no re-run; \`--full\` for untruncated)
+- Debugging: \`--dry-run\` resolves each step's interpolations and shows what they evaluate to without executing actions, code, bash or file steps (transform and condition expressions are evaluated, in the sandbox; \`$.steps.*\` refs are reported as deferred); \`--stop-after <stepId>\` runs up to a step then stops; \`--dry-run --stop-after <stepId>\` runs earlier steps for real then dry-resolves the target against their output; \`flow inspect <runId>\` shows a past run's per-step outputs (post-mortem, no re-run; \`--full\` for untruncated)
 
 ### 3. Relay \u2014 Webhook event forwarding between platforms
 Receive webhooks from platforms (Stripe, GitHub, Airtable, Attio, Google Calendar) and forward event data to any connected platform using passthrough actions with Handlebars templates. No middleware, no code.
@@ -13225,8 +13245,9 @@ function copyDir(src, dest) {
     if (entry.name === SKILL_STAMP) continue;
     const from = path12.join(src, entry.name);
     const to = path12.join(dest, entry.name);
+    if (entry.isSymbolicLink()) continue;
     if (entry.isDirectory()) copyDir(from, to);
-    else fs14.copyFileSync(from, to);
+    else if (entry.isFile()) fs14.copyFileSync(from, to);
   }
 }
 function removePath(target) {
@@ -13253,20 +13274,50 @@ function linkDir(target, linkPath) {
   copyDir(target, linkPath);
   return "copy";
 }
+function knownLinkPaths(skill, scope) {
+  const canonical = `${UNIVERSAL_PROJECT_DIR}/${skill.dirName}`;
+  return new Set(
+    SKILL_AGENT_TARGETS.map((a) => `${scope === "project" ? a.projectDir : a.homeDir}/${skill.dirName}`).filter((p9) => p9 !== canonical)
+  );
+}
+function stampLinkPath(skill, plan, rel) {
+  return knownLinkPaths(skill, plan.scope).has(toPosix(rel)) ? fromStamp(plan.root, rel) : null;
+}
+function assertInsideProject(plan, target) {
+  if (plan.scope !== "project") return;
+  let dir = path12.dirname(target);
+  while (!fs14.existsSync(dir)) {
+    const parent = path12.dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  const realRoot = fs14.realpathSync(plan.root);
+  const rel = path12.relative(realRoot, fs14.realpathSync(dir));
+  if (rel.startsWith("..") || path12.isAbsolute(rel)) {
+    throw new Error(`Refusing to change ${target}: a folder on that path leads outside the project (${plan.root}).`);
+  }
+}
 function installSkill(skill, source, plan, cliVersion2) {
   const canonical = canonicalSkillDir(skill, plan);
   const previous = readStamp(canonical);
   const { readers, folders } = resolveAgentFolders(plan);
   const nextPaths = new Set(folders.map((f) => `${f.dir}/${skill.dirName}`));
+  const targets = folders.map((folder) => {
+    const rel = `${folder.dir}/${skill.dirName}`;
+    return { rel, full: fromStamp(plan.root, rel), agents: folder.agents };
+  });
+  assertInsideProject(plan, canonical);
+  for (const t of targets) assertInsideProject(plan, t.full);
   for (const link of previous?.links ?? []) {
-    if (!nextPaths.has(toPosix(link.path))) removePath(fromStamp(plan.root, link.path));
+    if (nextPaths.has(toPosix(link.path))) continue;
+    const full = stampLinkPath(skill, plan, link.path);
+    if (!full) continue;
+    assertInsideProject(plan, full);
+    removePath(full);
   }
   removePath(canonical);
   copyDir(source.dir, canonical);
-  const links = folders.map((folder) => {
-    const rel = `${folder.dir}/${skill.dirName}`;
-    return { path: rel, kind: linkDir(canonical, fromStamp(plan.root, rel)), agents: folder.agents };
-  });
+  const links = targets.map((t) => ({ path: t.rel, kind: linkDir(canonical, t.full), agents: t.agents }));
   const stamp = {
     skill: skill.name,
     package: skill.packageName,
@@ -13285,8 +13336,11 @@ function removeSkill(skill, plan) {
   const stamp = readStamp(canonical);
   if (!stamp && !fs14.existsSync(path12.join(canonical, "SKILL.md"))) return { removed: false, paths: [] };
   const paths = [];
+  assertInsideProject(plan, canonical);
   for (const link of stamp?.links ?? []) {
-    const full = fromStamp(plan.root, link.path);
+    const full = stampLinkPath(skill, plan, link.path);
+    if (!full) continue;
+    assertInsideProject(plan, full);
     if (fs14.existsSync(full) || isDanglingLink(full)) {
       removePath(full);
       paths.push(full);
@@ -13884,7 +13938,7 @@ var flow = program.command("flow").alias("f").description("Create, execute, and
 flow.command("create [key]").description("Create a new workflow from JSON definition").option("--definition <json>", "Workflow definition as JSON string").option("-o, --output <path>", "Custom output path (default .one/flows/<key>/flow.json)").action(async (key, options) => {
   await flowCreateCommand(key, options);
 });
-flow.command("execute <keyOrPath>").alias("x").description("Execute a workflow by key or file path").option("-i, --input <name=value>", "Input parameter (repeatable)", collect, []).option("--dry-run", "Resolve each step's interpolations and show what they evaluate to, without executing any step ($.steps.* refs resolve at runtime)").option("--mock", "With --dry-run: execute transforms/code with realistic mock API responses").option("--stop-after <stepId>", "Execute steps up to and including <stepId>, then stop (later steps are not run). With --dry-run, runs earlier steps for real and dry-resolves <stepId> against their output without executing it. See: one flow inspect").option("--skip-validation", "Skip input validation against action schemas").option("--allow-bash", "Allow bash step execution (disabled by default for security)").option("-v, --verbose", "Show full request/response for each step").option("--output-file <path>", "Write the full result to a file (streamed) instead of stdout \u2014 avoids truncation/string-limit errors for large results; stdout/agent output then carries an outputFile pointer").action(async (keyOrPath, options) => {
+flow.command("execute <keyOrPath>").alias("x").description("Execute a workflow by key or file path").option("-i, --input <name=value>", "Input parameter (repeatable)", collect, []).option("--dry-run", "Resolve each step's interpolations and show what they evaluate to, without running actions, code, bash or file steps. Transform and condition expressions are evaluated in the sandbox ($.steps.* refs resolve at runtime)").option("--mock", "With --dry-run: execute transforms/code with realistic mock API responses").option("--stop-after <stepId>", "Execute steps up to and including <stepId>, then stop (later steps are not run). With --dry-run, runs earlier steps for real and dry-resolves <stepId> against their output without executing it. See: one flow inspect").option("--skip-validation", "Skip input validation against action schemas").option("--allow-bash", "Allow bash step execution (disabled by default for security)").option("--allow-code", "Allow code.module steps, which run a .mjs file with full Node access (disabled by default for security). Inline transforms, conditions and code.source run sandboxed and need no flag").option("-v, --verbose", "Show full request/response for each step").option("--output-file <path>", "Write the full result to a file (streamed) instead of stdout \u2014 avoids truncation/string-limit errors for large results; stdout/agent output then carries an outputFile pointer").action(async (keyOrPath, options) => {
   await flowExecuteCommand(keyOrPath, options);
 });
 flow.command("list").alias("ls").description("List all workflows in .one/flows/").action(async () => {
@@ -13893,7 +13947,7 @@ flow.command("list").alias("ls").description("List all workflows in .one/flows/"
 flow.command("validate <keyOrPath>").description("Validate a workflow JSON file").action(async (keyOrPath) => {
   await flowValidateCommand(keyOrPath);
 });
-flow.command("resume <runId>").description("Resume a paused or failed workflow run").option("--allow-bash", "Allow bash step execution (disabled by default for security) \u2014 required to resume any flow containing bash steps").action(async (runId, options) => {
+flow.command("resume <runId>").description("Resume a paused or failed workflow run").option("--allow-bash", "Allow bash step execution (disabled by default for security) \u2014 required to resume any flow containing bash steps").option("--allow-code", "Allow code.module steps (full Node access) \u2014 required to resume any flow containing them").action(async (runId, options) => {
   await flowResumeCommand(runId, options);
 });
 flow.command("runs [flowKey]").description("List workflow runs (optionally filtered by flow key)").action(async (flowKey) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.13.0",
+  "version": "2.14.1",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/references/flows.md

@@ -25,7 +25,7 @@ If a flow's description doesn't tell you how to run it, treat that as a bug in t
 **Storage layout:**
 
 - **Folder layout (REQUIRED for new flows):** `.one/flows/<key>/flow.json`, with an optional `lib/` subfolder for `.mjs` code modules. Like a skill — the folder groups the spec with its helper code, so the whole flow is shareable. **Always create new flows here.**
-- **Legacy single-file layout (DEPRECATED):** `.one/flows/<key>.flow.json`. Still loads and runs for backward compatibility, but do not create new flows in this layout. When touching an existing single-file flow, migrate it: move `<key>.flow.json` to `<key>/flow.json` and extract any non-trivial `code.source` blocks into `<key>/lib/*.mjs` modules.
+- **Legacy single-file layout (DEPRECATED):** `.one/flows/<key>.flow.json`. Still loads and runs for backward compatibility, but do not create new flows in this layout. When touching an existing single-file flow, migrate it: move `<key>.flow.json` to `<key>/flow.json`. Move a `code.source` block into a `<key>/lib/*.mjs` module only if it needs files, network or timers: modules run with full Node access and make the flow require `--allow-code`.
 
 `one flow create` always writes the folder layout.
 
@@ -93,20 +93,20 @@ process.stdout.write(JSON.stringify(items.filter(i => i.active)));
 }
 ```
 
-The module runs as a child `node` process: the flow context `$` is piped to stdin as JSON, and stdout is parsed as JSON and used as the step's output. Modules have full Node APIs available (unlike inline `code.source`, which is sandboxed). Use `code.module` for anything non-trivial; keep `code.source` for one-liners.
+The module runs as a child `node` process: the flow context `$` is piped to stdin as JSON, and stdout is parsed as JSON and used as the step's output. Modules have full Node APIs available (unlike inline `code.source`, which is sandboxed), so **a flow with any `code.module` step only runs with `--allow-code`**, the same way bash steps need `--allow-bash`. Say so in the flow's `description`. Use `code.module` when you need files, network or timers; keep pure data shaping in `code.source`.
 
-#### Inline `code.source` sandbox
+#### Sandbox for inline JavaScript
 
-Inline `code.source` runs inside an async function with a restricted `require`. Only the following Node built-ins are importable:
+Every piece of JavaScript written inside `flow.json` runs in a sandbox: `transform.expression`, `condition.expression`, `while.condition`, step-level `if`/`unless`, and `code.source`. A flow file can come from anywhere (a cloned repo, a shared folder, another agent), so this code cannot start programs, read or write files, or see the CLI's own environment.
 
-- `node:buffer`
-- `node:crypto`
-- `node:url`
-- `node:path`
+- It runs in a separate `node` process started with Node's permission model (`--permission`), an empty environment, and `eval`/`new Function` turned off.
+- `process`, `require` (outside `code.source`), `fetch`, `WebSocket`, `setTimeout`/`setInterval`, `__dirname` and `__filename` are not defined.
+- Inside `code.source`, `await require(name)` loads only these built-ins: `node:buffer`, `node:crypto`, `node:url`, `node:path`. Everything else (`fs`, `http`, `https`, `net`, `child_process`, `process`, `os`, `cluster`, `dgram`, `tls`, `vm`, `worker_threads`) throws `Module "<name>" is blocked in code steps`.
+- `$` is a copy of the flow context. Read from it and `return` a result; changing `$` inside a step does not change what later steps see.
+- Values cross into and out of the sandbox by structured clone: `Date`, `Map`, `Set`, `RegExp`, typed arrays and `undefined` survive; functions and symbols cannot be returned and fail the step.
+- Each evaluation has a 30-second limit for synchronous work and 60 seconds overall. A step that runs longer fails with `timed out`.
 
-Everything else — `fs`, `http`, `https`, `net`, `child_process`, `process`, `os`, `cluster`, `dgram`, `tls`, `vm`, `worker_threads` — is **blocked** and will throw `Module "<name>" is blocked in code steps`. The runtime also does not expose `process`, `__dirname`, `__filename`, `setTimeout`, or `fetch`.
-
-If you need any of those (filesystem reads, network calls, timers, etc.), use a `code.module` step instead — modules run as a real child `node` process and have the full Node API surface.
+These steps need no flag. If you need files, network calls or timers, use a `code.module` step, which requires `--allow-code`.
 
 When an inline `code.source` step throws at runtime, the error message reports the user-relative line and column plus the offending line of source — e.g. `Code step "blowup" failed at line 3:34\n  const c = $.steps.mk.output.data.score;\n  Cannot read properties of null (reading 'score')`. No need to bisect the step manually.
 
@@ -118,7 +118,7 @@ If you touch an existing `.one/flows/<key>.flow.json`, migrate it:
 
 1. `mkdir -p .one/flows/<key>/lib`
 2. `mv .one/flows/<key>.flow.json .one/flows/<key>/flow.json`
-3. Extract non-trivial `code.source` blocks into `lib/<step-id>.mjs` and swap the step config from `{ "source": "..." }` to `{ "module": "lib/<step-id>.mjs" }`. One-liners can stay inline.
+3. Leave `code.source` inline unless it needs files, network or timers. Inline code runs in the sandbox and needs no flag. Moving it to `lib/<step-id>.mjs` (`{ "module": "lib/<step-id>.mjs" }`) gives it full Node access and makes the flow require `--allow-code`.
 4. `one --agent flow validate <key>`
 5. Execute and confirm behavior is unchanged.
 
@@ -708,8 +708,9 @@ Three tools that turn "re-run the whole 40-step flow to debug step 30" into near
 - **Prefer passthrough actions over custom actions.** Custom actions add server-side fan-out that causes timeouts at scale. The flow runner handles pagination, retries, and rate limiting locally. Find with `-t knowledge` to reach passthrough endpoints (e.g. GET `/gmail/v1/users/{userId}/threads` instead of POST `/gmail/get-threads`)
 - Connection keys are inputs, not hardcoded — makes workflows portable
 - Action IDs in examples are placeholders — always use `actions find` to find real IDs
-- Code steps support `require('crypto')`, `require('buffer')`, `require('url')`, `require('path')` — `fs`, `http`, `child_process` are blocked
+- Transforms, conditions, `if`/`unless` and `code.source` run in a sandbox with no file, process or network access. `code.source` supports `require('crypto')`, `require('buffer')`, `require('url')`, `require('path')`; `fs`, `http`, `child_process` are blocked
 - Bash steps require `--allow-bash` flag
+- `code.module` steps require `--allow-code` flag (they run with full Node access)
 - Action steps validate required params before executing — pass `--skip-validation` to bypass
 - `--mock` now returns realistic example data from action schemas (instead of echoed config)
 - State is persisted after every step — resume picks up where it left off