@withone/cli 2.14.1 → 2.14.4

package/README.md

@@ -487,7 +487,7 @@ one sync run stripe --full-refresh
 | `schedule add/list/status/remove/repair` | Cron-backed scheduled syncs with drift detection |
 | `remove <platform>` | Delete synced data (`--dry-run` to preview) |
 
-Change hooks (`onInsert`, `onUpdate`, `onChange`) fire per-page during sync — pipe to a shell command, a flow, or an event log. Root-array responses (e.g. Hacker News `/v0/topstories.json` → `[9129911, 9129199, ...]`) are supported by setting `resultsPath` to `""`, `"$"`, or `"."`; primitive elements are auto-wrapped as `{ [idField]: value }`. Run `one guide sync` or `one guide memory` for the full reference.
+Change hooks (`onInsert`, `onUpdate`, `onChange`) fire per-page during sync — pipe to a shell command, a flow, or an event log. Shell commands in a profile (`transform` and hooks other than `"log"`) only run once approved for that project: commands you pass in `sync init --config` are approved automatically, and commands that arrive in a profile on disk (for example from a cloned repo) need `one sync approve <platform>`. A change to an approved command needs approving again. Root-array responses (e.g. Hacker News `/v0/topstories.json` → `[9129911, 9129199, ...]`) are supported by setting `resultsPath` to `""`, `"$"`, or `"."`; primitive elements are auto-wrapped as `{ [idField]: value }`. Run `one guide sync` or `one guide memory` for the full reference.
 
 ### `one relay`
 

package/dist/{chunk-IM3OA7CU.js → chunk-33KUKSRH.js}

@@ -3223,7 +3223,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-SRO6YL62.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-PUFQASEJ.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -3330,7 +3330,7 @@ function resolveBashEnv(envConfig, context, stepId) {
           os2.tmpdir(),
           `one-flow-${stepId}-${key}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`
         );
-        fs4.writeFileSync(tmp, json, { encoding: "utf-8" });
+        fs4.writeFileSync(tmp, json, { encoding: "utf-8", mode: 384 });
         tempFiles.push(tmp);
         out[key] = tmp;
         continue;
@@ -3768,9 +3768,21 @@ var RUNS_DIR = ".one/flows/.runs";
 var LOGS_DIR = ".one/flows/.logs";
 function ensureDir(dir) {
   if (!fs5.existsSync(dir)) {
-    fs5.mkdirSync(dir, { recursive: true });
+    fs5.mkdirSync(dir, { recursive: true, mode: 448 });
   }
 }
+var PRIVATE_FILE_MODE = 384;
+var PRIVATE_DIR_MODE = 448;
+function restrictMode(p, mode) {
+  try {
+    fs5.chmodSync(p, mode);
+  } catch {
+  }
+}
+function persistableState(state) {
+  if (!state.context) return state;
+  return { ...state, context: { ...state.context, env: {} } };
+}
 function generateRunId() {
   return crypto.randomBytes(6).toString("hex");
 }
@@ -3789,6 +3801,8 @@ var FlowRunner = class _FlowRunner {
     this.flowKey = flow.key;
     ensureDir(RUNS_DIR);
     ensureDir(LOGS_DIR);
+    restrictMode(RUNS_DIR, PRIVATE_DIR_MODE);
+    restrictMode(LOGS_DIR, PRIVATE_DIR_MODE);
     this.statePath = path6.join(RUNS_DIR, `${flow.key}-${this.runId}.state.json`);
     this.logPath = path6.join(LOGS_DIR, `${flow.key}-${this.runId}.log`);
     const resolvedInputs = { ...inputs };
@@ -3831,10 +3845,15 @@ var FlowRunner = class _FlowRunner {
       msg,
       ...data
     };
-    fs5.appendFileSync(this.logPath, JSON.stringify(entry) + "\n");
+    fs5.appendFileSync(this.logPath, JSON.stringify(entry) + "\n", { mode: PRIVATE_FILE_MODE });
   }
   saveState() {
-    fs5.writeFileSync(this.statePath, JSON.stringify(this.state, stripStepsAlias, 2));
+    fs5.writeFileSync(
+      this.statePath,
+      JSON.stringify(persistableState(this.state), stripStepsAlias, 2),
+      { mode: PRIVATE_FILE_MODE }
+    );
+    restrictMode(this.statePath, PRIVATE_FILE_MODE);
   }
   createEventHandler(externalHandler) {
     return (event) => {
@@ -4169,6 +4188,7 @@ export {
   getStepTypeDescriptor,
   getNestedStepsKeys,
   generateFlowGuide,
+  persistableState,
   stripStepsAlias,
   FlowRunner,
   resolveFlowPath,

package/dist/{chunk-LEJKEGB6.js → chunk-AFZIE2QJ.js}

@@ -15,23 +15,57 @@ import {
 } from "./chunk-4H5L3SBY.js";
 
 // src/commands/mem/migrate.ts
-import fs4 from "fs";
-import path4 from "path";
+import fs5 from "fs";
+import path5 from "path";
 import * as p from "@clack/prompts";
 
 // src/lib/memory/sync/profile.ts
+import fs2 from "fs";
+import path2 from "path";
+
+// src/lib/memory/sync/names.ts
 import fs from "fs";
 import path from "path";
-var PROFILES_DIR = path.join(".one", "sync", "profiles");
+var SAFE_SYNC_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+function isSafeSyncName(value) {
+  return typeof value === "string" && value.length <= 128 && SAFE_SYNC_NAME.test(value) && !value.includes("..");
+}
+var UnsafeSyncNameError = class extends Error {
+  constructor(kind, value) {
+    super(
+      `Invalid sync ${kind} name ${JSON.stringify(value)}: use letters, digits, ".", "_" or "-", starting with a letter or digit, and no "..".`
+    );
+    this.name = "UnsafeSyncNameError";
+  }
+};
+function assertSafeSyncNames(platform, model) {
+  if (!isSafeSyncName(platform)) throw new UnsafeSyncNameError("platform", platform);
+  if (model !== void 0 && !isSafeSyncName(model)) throw new UnsafeSyncNameError("model", model);
+}
+function ensureDirInsideProject(dirRel) {
+  fs.mkdirSync(dirRel, { recursive: true });
+  const root = fs.realpathSync(process.cwd());
+  const real = fs.realpathSync(dirRel);
+  if (real !== root && !real.startsWith(root + path.sep)) {
+    throw new Error(`Refusing to use ${dirRel}: it resolves outside the project (${real}).`);
+  }
+  return dirRel;
+}
+
+// src/lib/memory/sync/profile.ts
+var PROFILES_DIR = path2.join(".one", "sync", "profiles");
 function profilePath(platform, model) {
-  return path.join(PROFILES_DIR, `${platform}_${model}.json`);
+  assertSafeSyncNames(platform, model);
+  return path2.join(PROFILES_DIR, `${platform}_${model}.json`);
 }
 function readProfile(platform, model) {
   const filePath = profilePath(platform, model);
   try {
-    if (!fs.existsSync(filePath)) return null;
-    const raw = fs.readFileSync(filePath, "utf-8");
-    return JSON.parse(raw);
+    if (!fs2.existsSync(filePath)) return null;
+    const raw = fs2.readFileSync(filePath, "utf-8");
+    const profile = JSON.parse(raw);
+    if (!isSafeSyncName(profile?.platform) || !isSafeSyncName(profile?.model)) return null;
+    return profile;
   } catch {
     return null;
   }
@@ -61,9 +95,9 @@ function writeProfile(profile) {
   if (!profile.pagination.type) {
     throw new Error("Missing required field: pagination.type");
   }
-  fs.mkdirSync(PROFILES_DIR, { recursive: true });
+  fs2.mkdirSync(PROFILES_DIR, { recursive: true });
   const filePath = profilePath(profile.platform, profile.model);
-  fs.writeFileSync(filePath, JSON.stringify(profile, null, 2));
+  fs2.writeFileSync(filePath, JSON.stringify(profile, null, 2));
 }
 async function resolveProfileConnectionKey(api, profile, cache) {
   if (profile.connectionKey) return profile.connectionKey;
@@ -76,18 +110,25 @@ async function resolveProfileConnectionKey(api, profile, cache) {
   return conn.key;
 }
 function writeDraftProfile(platform, model, draft) {
-  fs.mkdirSync(PROFILES_DIR, { recursive: true });
+  fs2.mkdirSync(PROFILES_DIR, { recursive: true });
   const filePath = profilePath(platform, model);
-  fs.writeFileSync(filePath, JSON.stringify(draft, null, 2));
+  fs2.writeFileSync(filePath, JSON.stringify(draft, null, 2));
 }
 function listProfiles(platform) {
-  if (!fs.existsSync(PROFILES_DIR)) return [];
-  const files = fs.readdirSync(PROFILES_DIR).filter((f) => f.endsWith(".json"));
+  if (!fs2.existsSync(PROFILES_DIR)) return [];
+  const files = fs2.readdirSync(PROFILES_DIR).filter((f) => f.endsWith(".json"));
   const profiles = [];
   for (const file of files) {
     try {
-      const raw = fs.readFileSync(path.join(PROFILES_DIR, file), "utf-8");
+      const raw = fs2.readFileSync(path2.join(PROFILES_DIR, file), "utf-8");
       const profile = JSON.parse(raw);
+      if (!isSafeSyncName(profile?.platform) || !isSafeSyncName(profile?.model)) {
+        process.stderr.write(
+          `Skipping sync profile ${file}: platform and model must be plain names (letters, digits, ".", "_", "-", no "..").
+`
+        );
+        continue;
+      }
       if (!platform || profile.platform === platform) {
         profiles.push(profile);
       }
@@ -121,25 +162,25 @@ function generateTemplate(platform, model, actionId) {
 }
 
 // src/lib/memory/sync/builtin-profiles.ts
-import fs2 from "fs";
-import path2 from "path";
+import fs3 from "fs";
+import path3 from "path";
 import { fileURLToPath } from "url";
 function getProfilesDir() {
   const thisFile = fileURLToPath(import.meta.url);
-  const thisDir = path2.dirname(thisFile);
+  const thisDir = path3.dirname(thisFile);
   for (let i = 1; i <= 4; i++) {
-    const candidate = path2.resolve(thisDir, ...Array(i).fill(".."), "profiles");
-    if (fs2.existsSync(candidate)) return candidate;
+    const candidate = path3.resolve(thisDir, ...Array(i).fill(".."), "profiles");
+    if (fs3.existsSync(candidate)) return candidate;
   }
   return "";
 }
 function loadBuiltinProfile(platform, model) {
   const dir = getProfilesDir();
   if (!dir) return null;
-  const filePath = path2.join(dir, platform, `${model}.json`);
+  const filePath = path3.join(dir, platform, `${model}.json`);
   try {
-    if (!fs2.existsSync(filePath)) return null;
-    const raw = fs2.readFileSync(filePath, "utf-8");
+    if (!fs3.existsSync(filePath)) return null;
+    const raw = fs3.readFileSync(filePath, "utf-8");
     return JSON.parse(raw);
   } catch {
     return null;
@@ -159,20 +200,20 @@ function listBuiltinProfiles(platform) {
   if (!dir) return [];
   const profiles = [];
   try {
-    const platforms = platform ? [platform] : fs2.readdirSync(dir).filter((f) => {
+    const platforms = platform ? [platform] : fs3.readdirSync(dir).filter((f) => {
       try {
-        return fs2.statSync(path2.join(dir, f)).isDirectory();
+        return fs3.statSync(path3.join(dir, f)).isDirectory();
       } catch {
         return false;
       }
     });
     for (const plat of platforms) {
-      const platDir = path2.join(dir, plat);
-      if (!fs2.existsSync(platDir)) continue;
-      const files = fs2.readdirSync(platDir).filter((f) => f.endsWith(".json"));
+      const platDir = path3.join(dir, plat);
+      if (!fs3.existsSync(platDir)) continue;
+      const files = fs3.readdirSync(platDir).filter((f) => f.endsWith(".json"));
       for (const file of files) {
         try {
-          const raw = fs2.readFileSync(path2.join(platDir, file), "utf-8");
+          const raw = fs3.readFileSync(path3.join(platDir, file), "utf-8");
           const profile = JSON.parse(raw);
           profiles.push(profile);
         } catch {
@@ -185,8 +226,8 @@ function listBuiltinProfiles(platform) {
 }
 
 // src/lib/memory/sync/db.ts
-import fs3 from "fs";
-import path3 from "path";
+import fs4 from "fs";
+import path4 from "path";
 
 // src/lib/memory/sync/sqlite-loader.ts
 var cached = null;
@@ -222,10 +263,10 @@ async function isSqliteAvailable() {
 }
 
 // src/lib/memory/sync/db.ts
-var DATA_DIR = path3.join(".one", "sync", "data");
+var DATA_DIR = path4.join(".one", "sync", "data");
 function listSyncedPlatforms() {
-  if (!fs3.existsSync(DATA_DIR)) return [];
-  return fs3.readdirSync(DATA_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(/\.db$/, ""));
+  if (!fs4.existsSync(DATA_DIR)) return [];
+  return fs4.readdirSync(DATA_DIR).filter((f) => f.endsWith(".db")).map((f) => f.replace(/\.db$/, ""));
 }
 function isDriverFault(err) {
   const code = err?.code;
@@ -255,8 +296,8 @@ function backupPathFor(dbPath, now = /* @__PURE__ */ new Date()) {
 }
 async function openDatabase(platform, opts = {}) {
   const Database = await loadSqlite();
-  fs3.mkdirSync(DATA_DIR, { recursive: true });
-  const dbPath = path3.join(DATA_DIR, `${platform}.db`);
+  fs4.mkdirSync(DATA_DIR, { recursive: true });
+  const dbPath = path4.join(DATA_DIR, `${platform}.db`);
   if (opts.readonly) {
     return new Database(dbPath, { readonly: true, fileMustExist: true });
   }
@@ -280,7 +321,7 @@ Rebuild it against this Node with:
 Underlying error: ${detail}`
       );
     }
-    if (!fs3.existsSync(dbPath)) throw err;
+    if (!fs4.existsSync(dbPath)) throw err;
     if (passesIntegrityCheck(Database, dbPath)) {
       const detail = err instanceof Error ? err.message.split("\n")[0] : String(err);
       throw new Error(
@@ -290,7 +331,7 @@ Underlying error: ${detail}`
       );
     }
     const backupPath = backupPathFor(dbPath);
-    fs3.renameSync(dbPath, backupPath);
+    fs4.renameSync(dbPath, backupPath);
     process.stderr.write(
       `Database at ${dbPath} failed its integrity check. Backup saved at ${backupPath}, starting fresh.
 `
@@ -303,12 +344,12 @@ Underlying error: ${detail}`
   return db;
 }
 function getDatabasePath(platform) {
-  return path3.join(DATA_DIR, `${platform}.db`);
+  return path4.join(DATA_DIR, `${platform}.db`);
 }
 function getDatabaseSize(platform) {
   const dbPath = getDatabasePath(platform);
-  if (!fs3.existsSync(dbPath)) return "0 B";
-  const stats = fs3.statSync(dbPath);
+  if (!fs4.existsSync(dbPath)) return "0 B";
+  const stats = fs4.statSync(dbPath);
   const bytes = stats.size;
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -444,16 +485,16 @@ function countRecords(db, model) {
 }
 function deleteDatabase(platform) {
   const dbPath = getDatabasePath(platform);
-  if (fs3.existsSync(dbPath)) fs3.unlinkSync(dbPath);
-  if (fs3.existsSync(dbPath + "-wal")) fs3.unlinkSync(dbPath + "-wal");
-  if (fs3.existsSync(dbPath + "-shm")) fs3.unlinkSync(dbPath + "-shm");
+  if (fs4.existsSync(dbPath)) fs4.unlinkSync(dbPath);
+  if (fs4.existsSync(dbPath + "-wal")) fs4.unlinkSync(dbPath + "-wal");
+  if (fs4.existsSync(dbPath + "-shm")) fs4.unlinkSync(dbPath + "-shm");
 }
 
 // src/lib/memory/sync/mem-writer.ts
-function resolveWildcardPath(root, path5) {
-  const segments = path5.split("[]");
+function resolveWildcardPath(root, path6) {
+  const segments = path6.split("[]");
   if (segments.length === 1) {
-    return [getByDotPath(root, path5)];
+    return [getByDotPath(root, path6)];
   }
   const recurse = (value, idx) => {
     if (value === null || value === void 0) return [];
@@ -479,8 +520,8 @@ function resolveWildcardPath(root, path5) {
 function extractSearchableFromPaths(record, paths) {
   const parts = [];
   const perPath = [];
-  for (const path5 of paths) {
-    const values = resolveWildcardPath(record, path5);
+  for (const path6 of paths) {
+    const values = resolveWildcardPath(record, path6);
     const collected = [];
     const absorb = (v) => {
       if (v === null || v === void 0) return;
@@ -496,9 +537,9 @@ function extractSearchableFromPaths(record, paths) {
     for (const v of values) absorb(v);
     if (collected.length > 0) {
       parts.push(...collected);
-      perPath.push({ path: path5, found: true, sample: collected.join(" ").slice(0, 80) });
+      perPath.push({ path: path6, found: true, sample: collected.join(" ").slice(0, 80) });
     } else {
-      perPath.push({ path: path5, found: false, sample: "" });
+      perPath.push({ path: path6, found: false, sample: "" });
     }
   }
   const text = parts.join(" ").replace(/\s+/g, " ").trim();
@@ -616,9 +657,9 @@ function deriveFields(record, derive) {
   const out = {};
   if (!derive) return out;
   for (const [field, spec] of Object.entries(derive)) {
-    const { path: path5, extract } = typeof spec === "string" ? { path: spec, extract: void 0 } : spec;
-    if (!path5) continue;
-    const values = resolveIdentityPath(record, path5).filter((v) => v !== null && v !== void 0 && typeof v !== "object");
+    const { path: path6, extract } = typeof spec === "string" ? { path: spec, extract: void 0 } : spec;
+    if (!path6) continue;
+    const values = resolveIdentityPath(record, path6).filter((v) => v !== null && v !== void 0 && typeof v !== "object");
     if (values.length === 0) continue;
     if (extract === "email") {
       const emails = values.flatMap((v) => identityValuesFor("email", v));
@@ -630,11 +671,11 @@ function deriveFields(record, derive) {
   }
   return out;
 }
-function tokenizeIdentityPath(path5) {
+function tokenizeIdentityPath(path6) {
   const tokens = [];
   const re = /([^.[\]]+)|\[([^\]]*)\]/g;
   let m;
-  while ((m = re.exec(path5)) !== null) {
+  while ((m = re.exec(path6)) !== null) {
     if (m[1] !== void 0) {
       tokens.push({ type: "field", name: m[1] });
     } else {
@@ -653,9 +694,9 @@ function tokenizeIdentityPath(path5) {
   }
   return tokens;
 }
-function resolveIdentityPath(root, path5) {
+function resolveIdentityPath(root, path6) {
   let frontier = [root];
-  for (const tok of tokenizeIdentityPath(path5)) {
+  for (const tok of tokenizeIdentityPath(path6)) {
     const next = [];
     for (const cur of frontier) {
       if (cur === null || cur === void 0) continue;
@@ -683,10 +724,10 @@ function resolveIdentityPath(root, path5) {
   }
   return frontier;
 }
-function keysForEntry(record, prefix, path5) {
-  if (!prefix || !path5) return [];
+function keysForEntry(record, prefix, path6) {
+  if (!prefix || !path6) return [];
   const out = [];
-  for (const raw of resolveIdentityPath(record, path5)) {
+  for (const raw of resolveIdentityPath(record, path6)) {
     for (const value of identityValuesFor(prefix, raw)) out.push(`${prefix}:${value}`);
   }
   return out;
@@ -926,10 +967,10 @@ async function memMigrateCommand(flags) {
       }
     }
   }
-  const dataDir = path4.join(".one", "sync", "data");
+  const dataDir = path5.join(".one", "sync", "data");
   let cleanupFiles = [];
-  if (flags.cleanup && fs4.existsSync(dataDir)) {
-    cleanupFiles = fs4.readdirSync(dataDir).map((f) => path4.join(dataDir, f));
+  if (flags.cleanup && fs5.existsSync(dataDir)) {
+    cleanupFiles = fs5.readdirSync(dataDir).map((f) => path5.join(dataDir, f));
   }
   let cleanupDeleted = false;
   if (flags.cleanup) {
@@ -943,7 +984,7 @@ async function memMigrateCommand(flags) {
       } else {
         for (const full of cleanupFiles) {
           try {
-            fs4.unlinkSync(full);
+            fs5.unlinkSync(full);
           } catch {
           }
         }
@@ -1056,12 +1097,12 @@ function reviveStringifiedJson(row) {
 }
 function isBuiltinNewerThanInstalled(platform, model) {
   try {
-    const installed = path4.join(".one", "sync", "profiles", `${platform}_${model}.json`);
-    if (!fs4.existsSync(installed)) return void 0;
-    const installedStat = fs4.statSync(installed);
+    const installed = path5.join(".one", "sync", "profiles", `${platform}_${model}.json`);
+    if (!fs5.existsSync(installed)) return void 0;
+    const installedStat = fs5.statSync(installed);
     const builtinPath = resolveBuiltinProfilePath(platform, model);
     if (!builtinPath) return void 0;
-    const builtinStat = fs4.statSync(builtinPath);
+    const builtinStat = fs5.statSync(builtinPath);
     return builtinStat.mtimeMs > installedStat.mtimeMs;
   } catch {
     return void 0;
@@ -1070,11 +1111,13 @@ function isBuiltinNewerThanInstalled(platform, model) {
 function resolveBuiltinProfilePath(platform, model) {
   const dir = getProfilesDir();
   if (!dir) return null;
-  const candidate = path4.join(dir, platform, `${model}.json`);
-  return fs4.existsSync(candidate) ? candidate : null;
+  const candidate = path5.join(dir, platform, `${model}.json`);
+  return fs5.existsSync(candidate) ? candidate : null;
 }
 
 export {
+  assertSafeSyncNames,
+  ensureDirInsideProject,
   readProfile,
   writeProfile,
   resolveProfileConnectionKey,

package/dist/{flow-runner-SRO6YL62.js → flow-runner-PUFQASEJ.js}

@@ -7,12 +7,13 @@ import {
   listFlows,
   loadFlow,
   loadFlowWithMeta,
+  persistableState,
   resolveFlowPath,
   saveFlow,
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-IM3OA7CU.js";
+} from "./chunk-33KUKSRH.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-Q6PWTATS.js";
 import "./chunk-XUAUDMQE.js";
@@ -25,6 +26,7 @@ export {
   listFlows,
   loadFlow,
   loadFlowWithMeta,
+  persistableState,
   resolveFlowPath,
   saveFlow,
   stripStepsAlias,