@withone/cli 2.3.2 → 2.5.0

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-6FA7KUNQ.js";
+} from "./chunk-MRQ47KSZ.js";
 import {
   memSqlCommand
 } from "./chunk-7FPQOAQ4.js";
@@ -147,7 +147,7 @@ import {
 
 // src/cli.ts
 import { createRequire as createRequire3 } from "module";
-import path13 from "path";
+import path15 from "path";
 import { Command } from "commander";
 
 // src/commands/init.ts
@@ -1686,25 +1686,25 @@ async function loginCommand() {
   let targetScope = "global";
   const existingKey = getApiKey();
   if (existingKey) {
-    const pc17 = (await import("picocolors")).default;
+    const pc18 = (await import("picocolors")).default;
     const resolved = resolveConfig();
     const whoami2 = resolved.config?.whoami;
     const env2 = getEnvFromApiKey(existingKey);
-    const envLabel2 = env2 === "test" ? pc17.yellow("test") : pc17.green("live");
-    const currentScope = resolved.scope === "project" ? pc17.cyan("local config") : pc17.magenta("global config");
+    const envLabel2 = env2 === "test" ? pc18.yellow("test") : pc18.green("live");
+    const currentScope = resolved.scope === "project" ? pc18.cyan("local config") : pc18.magenta("global config");
     const lines = ["You are already logged in.", ""];
     if (whoami2) {
       const contextParts2 = [];
       if (whoami2.organization) contextParts2.push(whoami2.organization.name);
       if (whoami2.project) contextParts2.push(whoami2.project.name);
       const scopeDisplay2 = contextParts2.length > 0 ? contextParts2.join(" / ") : "Personal";
-      lines.push(`${pc17.bold(scopeDisplay2)} ${pc17.dim("\xB7")} ${envLabel2}`);
-      lines.push(`${whoami2.user.name} ${pc17.dim(`(${whoami2.user.email})`)}`);
-      if (whoami2.organization) lines.push(`${pc17.dim("Org:")} ${whoami2.organization.name}`);
-      if (whoami2.project) lines.push(`${pc17.dim("Project:")} ${whoami2.project.name}`);
+      lines.push(`${pc18.bold(scopeDisplay2)} ${pc18.dim("\xB7")} ${envLabel2}`);
+      lines.push(`${whoami2.user.name} ${pc18.dim(`(${whoami2.user.email})`)}`);
+      if (whoami2.organization) lines.push(`${pc18.dim("Org:")} ${whoami2.organization.name}`);
+      if (whoami2.project) lines.push(`${pc18.dim("Project:")} ${whoami2.project.name}`);
     }
     lines.push("");
-    lines.push(`${pc17.dim("Stored in")} ${currentScope}`);
+    lines.push(`${pc18.dim("Stored in")} ${currentScope}`);
     p2.note(lines.join("\n"));
     const scopeChoice = await p2.select({
       message: "Where would you like to log in?",
@@ -1723,42 +1723,42 @@ async function loginCommand() {
   if (!result) return;
   const { apiKey, whoami, keyName, grant, knowledgeOnly } = result;
   saveCredentials(apiKey, targetScope, { keyName, whoami, knowledgeOnly });
-  const pc16 = (await import("picocolors")).default;
+  const pc17 = (await import("picocolors")).default;
   const env = getEnvFromApiKey(apiKey);
   const contextParts = [];
   if (whoami.organization) contextParts.push(whoami.organization.name);
   if (whoami.project) contextParts.push(whoami.project.name);
   const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-  const envLabel = env === "test" ? pc16.yellow("test") : pc16.green("live");
-  const configLabel = targetScope === "project" ? pc16.cyan("local config") : pc16.magenta("global config");
+  const envLabel = env === "test" ? pc17.yellow("test") : pc17.green("live");
+  const configLabel = targetScope === "project" ? pc17.cyan("local config") : pc17.magenta("global config");
   const infoLines = [
-    `${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`,
-    `${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`
+    `${pc17.bold(scopeDisplay)} ${pc17.dim("\xB7")} ${envLabel}`,
+    `${whoami.user.name} ${pc17.dim(`(${whoami.user.email})`)}`
   ];
-  if (keyName) infoLines.push(`${pc16.dim("Key:")} ${keyName}`);
-  infoLines.push(...grantNoteLines(grant, pc16.dim("Access:")));
-  if (whoami.organization) infoLines.push(`${pc16.dim("Org:")} ${whoami.organization.name}`);
-  if (whoami.project) infoLines.push(`${pc16.dim("Project:")} ${whoami.project.name}`);
+  if (keyName) infoLines.push(`${pc17.dim("Key:")} ${keyName}`);
+  infoLines.push(...grantNoteLines(grant, pc17.dim("Access:")));
+  if (whoami.organization) infoLines.push(`${pc17.dim("Org:")} ${whoami.organization.name}`);
+  if (whoami.project) infoLines.push(`${pc17.dim("Project:")} ${whoami.project.name}`);
   infoLines.push("");
-  infoLines.push(`${pc16.dim("Stored in")} ${configLabel}`);
+  infoLines.push(`${pc17.dim("Stored in")} ${configLabel}`);
   p2.note(infoLines.join("\n"), "Logged in");
   console.log();
-  console.log(`  ${pc16.dim("Next steps:")}`);
-  console.log(`  ${pc16.cyan("one add <platform>")}  ${pc16.dim("\u2014")} Connect a platform (e.g. gmail, slack, stripe)`);
+  console.log(`  ${pc17.dim("Next steps:")}`);
+  console.log(`  ${pc17.cyan("one add <platform>")}  ${pc17.dim("\u2014")} Connect a platform (e.g. gmail, slack, stripe)`);
   console.log();
-  console.log(pc16.bold("  Copy-paste this to your AI agent:"));
+  console.log(pc17.bold("  Copy-paste this to your AI agent:"));
   console.log();
-  console.log(pc16.cyan("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
-  console.log(pc16.cyan("  \u2502"));
-  console.log(pc16.cyan("  \u2502  The One CLI (`one`) is now installed on this machine. It"));
-  console.log(pc16.cyan("  \u2502  lets you interact with 750+ third-party platforms (Gmail,"));
-  console.log(pc16.cyan("  \u2502  Slack, Shopify, HubSpot, Stripe, GitHub, etc.) through"));
-  console.log(pc16.cyan("  \u2502  their APIs. Whenever you need to interact with any"));
-  console.log(pc16.cyan("  \u2502  third-party platform or external service, use the `one`"));
-  console.log(pc16.cyan("  \u2502  skill. Please save this to your project instructions or"));
-  console.log(pc16.cyan("  \u2502  memory so you remember it in future conversations."));
-  console.log(pc16.cyan("  \u2502"));
-  console.log(pc16.cyan("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc17.cyan("  \u250C\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  console.log(pc17.cyan("  \u2502"));
+  console.log(pc17.cyan("  \u2502  The One CLI (`one`) is now installed on this machine. It"));
+  console.log(pc17.cyan("  \u2502  lets you interact with 750+ third-party platforms (Gmail,"));
+  console.log(pc17.cyan("  \u2502  Slack, Shopify, HubSpot, Stripe, GitHub, etc.) through"));
+  console.log(pc17.cyan("  \u2502  their APIs. Whenever you need to interact with any"));
+  console.log(pc17.cyan("  \u2502  third-party platform or external service, use the `one`"));
+  console.log(pc17.cyan("  \u2502  skill. Please save this to your project instructions or"));
+  console.log(pc17.cyan("  \u2502  memory so you remember it in future conversations."));
+  console.log(pc17.cyan("  \u2502"));
+  console.log(pc17.cyan("  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
   console.log();
   p2.outro("Happy building!");
 }
@@ -2610,21 +2610,91 @@ async function resolveAllowedActions(api, actionIds) {
   );
   return resolved.filter((a) => a !== null);
 }
-function computeConnectionAccess(platform, permissions, allowedActionIds, grantedActions) {
-  if (!allowedActionIds.includes("*")) {
-    const actions2 = grantedActions.filter((a) => a.platform === platform).map(({ actionId, title, method }) => ({ actionId, title, method }));
-    return { policy: "actions", actions: actions2 };
+var UNRESTRICTED = { reachable: true, methods: null, actionIds: null };
+var UNREACHABLE = { reachable: false, methods: [], actionIds: [] };
+function serverEnvelope(doc, connectionKey) {
+  if (!doc) return UNRESTRICTED;
+  if (doc.rules === null) return { reachable: true, methods: doc.methods, actionIds: null };
+  const rule = doc.rules.find((r) => r.connectionKey === connectionKey);
+  if (!rule) return UNREACHABLE;
+  return {
+    reachable: true,
+    methods: rule.methods ?? doc.methods,
+    actionIds: rule.actionIds ?? null
+  };
+}
+function localEnvelope(permissions, actionIds, connectionKeys, connectionKey) {
+  if (!connectionKeys.includes("*") && !connectionKeys.includes(connectionKey)) return UNREACHABLE;
+  return {
+    reachable: true,
+    methods: PERMISSION_METHODS[permissions],
+    actionIds: actionIds.includes("*") ? null : actionIds
+  };
+}
+function intersectList(a, b) {
+  if (a === null) return b;
+  if (b === null) return a;
+  const upper = new Set(b.map((x) => x.toUpperCase()));
+  return a.filter((x) => upper.has(x.toUpperCase()));
+}
+function intersectEnvelopes(a, b) {
+  if (!a.reachable || !b.reachable) return UNREACHABLE;
+  return {
+    reachable: true,
+    methods: intersectList(a.methods, b.methods),
+    actionIds: a.actionIds === null ? b.actionIds : b.actionIds === null ? a.actionIds : a.actionIds.filter((id) => b.actionIds.includes(id))
+  };
+}
+function envelopeToAccess(envelope, resolved, localMethods = null) {
+  if (!envelope.reachable || envelope.methods !== null && envelope.methods.length === 0) {
+    return { access: { policy: "actions", actions: [] }, unresolved: [] };
+  }
+  if (envelope.actionIds !== null) {
+    const actions2 = envelope.actionIds.flatMap((id) => {
+      const hit = resolved.find((a) => a.actionId === id);
+      if (!hit) return [];
+      if (localMethods && !localMethods.includes(hit.method.toUpperCase())) return [];
+      return [{ actionId: hit.actionId, title: hit.title, method: hit.method }];
+    });
+    return {
+      access: { policy: "actions", actions: actions2 },
+      unresolved: envelope.actionIds.filter((id) => !resolved.some((a) => a.actionId === id))
+    };
   }
-  const methods = PERMISSION_METHODS[permissions];
-  if (methods !== null) {
-    return { policy: "methods", methods };
+  if (envelope.methods !== null) {
+    return { access: { policy: "methods", methods: envelope.methods.map((m) => m.toUpperCase()) }, unresolved: [] };
   }
-  return { policy: "full" };
+  return { access: { policy: "full" }, unresolved: [] };
 }
-function formatAccess(access, maxActions = 2) {
+var READ_WRITE = ["GET", "PATCH", "POST", "PUT"];
+function accessLevel(access) {
   switch (access.policy) {
     case "full":
       return "full";
+    case "methods": {
+      const set = [...new Set(access.methods.map((m) => m.toUpperCase()))].sort();
+      if (set.length === 0) return "none";
+      if (set.length === 1 && set[0] === "GET") return "read-only";
+      if (set.join(",") === READ_WRITE.join(",")) return "read-write";
+      return "custom";
+    }
+    case "actions":
+      return access.actions.length === 0 ? "none" : "custom";
+  }
+}
+var LEVEL_LABELS = {
+  full: "Full access",
+  "read-write": "Read & write",
+  "read-only": "Read only",
+  custom: "Custom",
+  none: "No access"
+};
+function formatAccess(access, maxActions = 2) {
+  const level = accessLevel(access);
+  if (level !== "custom") return LEVEL_LABELS[level];
+  switch (access.policy) {
+    case "full":
+      return LEVEL_LABELS.full;
     case "methods":
       return access.methods.join(", ");
     case "actions": {
@@ -2847,18 +2917,30 @@ async function connectionListCommand(options) {
   const spinner = createSpinner();
   spinner.start("Loading connections...");
   try {
-    const allConnections = await api.listConnections();
+    const [allConnections, serverAccess] = await Promise.all([
+      api.listConnections(),
+      api.getOwnAccess().then(
+        (doc) => ({ ok: true, doc }),
+        () => ({ ok: false, doc: null })
+      )
+    ]);
     const ac = getAccessControlFromAllSources();
     const permissions = ac.permissions || "admin";
     const allowedKeys = ac.connectionKeys || ["*"];
     const actionIds = ac.actionIds || ["*"];
     const knowledgeOnly = ac.knowledgeAgent || false;
-    const accessFiltered = allowedKeys.includes("*") ? allConnections : allConnections.filter((conn) => allowedKeys.includes(conn.key));
-    const resolvedActions = await resolveAllowedActions(api, actionIds);
-    const unresolvedActionIds = actionIds.includes("*") ? [] : actionIds.filter((id) => !resolvedActions.some((a) => a.actionId === id));
-    const grantedActions = resolvedActions.filter((a) => isMethodAllowed(a.method, permissions));
-    const accessFor = (platform) => computeConnectionAccess(platform, permissions, actionIds, grantedActions);
-    const hintText = accessHint(permissions, actionIds, knowledgeOnly);
+    const envelopeFor = (key) => intersectEnvelopes(serverEnvelope(serverAccess.doc, key), localEnvelope(permissions, actionIds, allowedKeys, key));
+    const accessFiltered = allConnections.filter((conn) => envelopeFor(conn.key).reachable);
+    const namedActionIds = new Set(actionIds.includes("*") ? [] : actionIds);
+    for (const rule of serverAccess.doc?.rules ?? []) for (const id of rule.actionIds ?? []) namedActionIds.add(id);
+    const resolvedActions = await resolveAllowedActions(api, [...namedActionIds]);
+    const unresolved = /* @__PURE__ */ new Set();
+    const accessFor = (conn) => {
+      const { access, unresolved: missing } = envelopeToAccess(envelopeFor(conn.key), resolvedActions, PERMISSION_METHODS[permissions]);
+      missing.forEach((id) => unresolved.add(id));
+      return access;
+    };
+    const hintText = accessHint(permissions, actionIds, knowledgeOnly, serverAccess.ok ? serverAccess.doc : void 0);
     const searchQuery = options?.search?.toLowerCase();
     const filtered = searchQuery ? accessFiltered.filter((conn) => conn.platform.toLowerCase().includes(searchQuery)) : accessFiltered;
     const limitArg = options?.limit ? parseInt(options.limit, 10) : void 0;
@@ -2875,10 +2957,11 @@ async function connectionListCommand(options) {
           key: conn.key,
           ...conn.name && { name: conn.name },
           ...conn.tags?.length && { tags: conn.tags },
-          access: accessFor(conn.platform)
+          access: withLevel(accessFor(conn))
         })),
+        accessSource: serverAccess.ok ? "server" : "local",
         ...knowledgeOnly && { knowledgeOnly: true },
-        ...unresolvedActionIds.length > 0 && { unresolvedActionIds },
+        ...unresolved.size > 0 && { unresolvedActionIds: [...unresolved] },
         ...hintText && { accessHint: hintText },
         ...limited.length < filtered.length && {
           hint: `Showing ${limited.length} of ${filtered.length} connections. Use --search <query> to filter by platform or --limit <n> to see more.`
@@ -2896,6 +2979,13 @@ async function connectionListCommand(options) {
 Try: ${pc6.cyan("one connection list")} to see all connections.`,
           "No Results"
         );
+      } else if (serverAccess.doc?.rules && allConnections.length === 0) {
+        p4.note(
+          `This key reaches no connections: it can search actions and read their docs, but runs none.
+
+Change it in the dashboard under API keys.`,
+          "No Connections"
+        );
       } else {
         p4.note(
           `No connections yet.
@@ -2913,10 +3003,9 @@ Add one with: ${pc6.cyan("one connection add gmail")}`,
       state: conn.state,
       key: conn.key,
       tags: conn.tags?.length ? conn.tags.join(", ") : "",
-      access: formatAccess(accessFor(conn.platform))
+      access: formatAccess(accessFor(conn))
     }));
     const hasTags = rows.some((r) => r.tags);
-    const hasScopedAccess = rows.some((r) => r.access !== "full");
     printTable(
       [
         { key: "status", label: "" },
@@ -2924,21 +3013,22 @@ Add one with: ${pc6.cyan("one connection add gmail")}`,
         { key: "state", label: "Status" },
         { key: "key", label: "Connection Key", color: pc6.dim },
         ...hasTags ? [{ key: "tags", label: "Tags", color: pc6.dim }] : [],
-        ...hasScopedAccess ? [{ key: "access", label: "Access", color: pc6.yellow }] : []
+        { key: "access", label: serverAccess.ok ? "Access" : "Access (CLI settings only)", color: pc6.yellow }
       ],
       rows
     );
     console.log();
-    if (hintText) {
-      const lines = [hintText];
-      if (unresolvedActionIds.length > 0) {
-        lines.push(
-          `Could not resolve ${unresolvedActionIds.length} allowlisted action id(s): ${unresolvedActionIds.join(", ")}`
-        );
+    if (hintText || unresolved.size > 0) {
+      const lines = hintText ? [hintText] : [];
+      if (unresolved.size > 0) {
+        lines.push(`Could not resolve ${unresolved.size} allowed action id(s): ${[...unresolved].join(", ")}`);
       }
-      p4.note(`${wrapText(lines.join("\n"))}
+      p4.note(
+        `${wrapText(lines.join("\n"))}
 
-Change it with: ${pc6.cyan("one config")}`, "Access");
+This key's access: dashboard \u2192 API keys. This CLI's own limits: ${pc6.cyan("one config")}`,
+        "Access"
+      );
     }
     if (displayed.length < filtered.length) {
       p4.note(
@@ -3012,21 +3102,35 @@ async function connectionDeleteCommand(connectionKey, options) {
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
-function accessHint(permissions, actionIds, knowledgeOnly) {
+function accessHint(permissions, actionIds, knowledgeOnly, server) {
   const parts = [];
+  if (server === void 0) {
+    parts.push(
+      "One did not report this key's access, so each `access` shows only this CLI's own settings; One may allow less. Check the key in the dashboard under API keys."
+    );
+  } else if (server?.rules && server.rules.length === 0) {
+    parts.push("This key reaches no connections: it can read docs and search actions, but no action will execute.");
+  } else if (server?.rules?.some((r) => r.actionIds)) {
+    parts.push(
+      "Some connections are action-scoped: their `access.actions` are the only actions you may run there \u2014 use them directly: `actions load <actionId>` reads their docs, no find needed."
+    );
+  }
   if (!actionIds.includes("*")) {
     parts.push(
-      "Action-scoped: each connection's `access.actions` are the only actions you may run \u2014 use them directly: `actions load <actionId>` reads their docs, no find needed."
+      "Action-scoped (local settings): each connection's `access.actions` are the only actions you may run \u2014 use them directly: `actions load <actionId>` reads their docs, no find needed."
     );
   } else if (permissions !== "admin") {
     const methods = PERMISSION_METHODS[permissions]?.join(", ") ?? "";
-    parts.push(`Permission level "${permissions}": only ${methods} actions will execute.`);
+    parts.push(`Permission level "${permissions}" (local settings): only ${methods} actions will execute.`);
   }
   if (knowledgeOnly) {
     parts.push("Knowledge-only mode: `actions execute` is disabled \u2014 read knowledge and write code instead.");
   }
   return parts.length > 0 ? parts.join(" ") : null;
 }
+function withLevel(access) {
+  return { ...access, level: accessLevel(access) };
+}
 function wrapText(text5, width = 72) {
   return text5.split("\n").map((paragraph) => {
     const lines = [];
@@ -3789,7 +3893,7 @@ var CUSTOM_ACTION_NOTE = '\n\nThis is a custom action: ALSO include "connectionK
 function codeGuideAction(action, knowledge, platform, tags, apiBase) {
   const base = apiBase.replace(/\/$/, "");
   const method = action.method.toUpperCase();
-  const path14 = action.path.startsWith("/") ? action.path : `/${action.path}`;
+  const path16 = action.path.startsWith("/") ? action.path : `/${action.path}`;
   const connEnv = `ONE_${platformEnvSegment(platform)}_CONNECTION_KEY`;
   const customNote = tags.includes("custom") ? CUSTOM_ACTION_NOTE : "";
   return `### ${actionHeading(action)}
@@ -3798,7 +3902,7 @@ function codeGuideAction(action, knowledge, platform, tags, apiBase) {
 ${knowledge ?? NO_KNOWLEDGE}
 
 ## Calling this action from code
-URL:    ${base}/passthrough${path14}
+URL:    ${base}/passthrough${path16}
 Method: ${method}
 Headers:
 - x-one-secret: the value of the ONE_SECRET env var
@@ -3809,7 +3913,7 @@ Headers:
 Environment variables: ONE_SECRET (their One API key) and ${connEnv} (the key of their ${platform} connection), both from the One dashboard.
 
 \`\`\`typescript
-const response = await fetch("${base}/passthrough${path14}", {
+const response = await fetch("${base}/passthrough${path16}", {
 method: "${method}",
 headers: {
 "x-one-secret": process.env.ONE_SECRET,
@@ -4554,32 +4658,32 @@ function validateStepsArray(steps, pathPrefix, errors) {
   const validTypes = FLOW_SCHEMA.stepTypes.map((st) => st.type);
   for (let i = 0; i < steps.length; i++) {
     const step = steps[i];
-    const path14 = `${pathPrefix}[${i}]`;
+    const path16 = `${pathPrefix}[${i}]`;
     if (!step || typeof step !== "object" || Array.isArray(step)) {
-      errors.push({ path: path14, message: "Step must be an object" });
+      errors.push({ path: path16, message: "Step must be an object" });
       continue;
     }
     const s = step;
     if (!s.id || typeof s.id !== "string") {
-      errors.push({ path: `${path14}.id`, message: 'Step must have a string "id"' });
+      errors.push({ path: `${path16}.id`, message: 'Step must have a string "id"' });
     }
     if (!s.name || typeof s.name !== "string") {
-      errors.push({ path: `${path14}.name`, message: 'Step must have a string "name"' });
+      errors.push({ path: `${path16}.name`, message: 'Step must have a string "name"' });
     }
     if (!s.type || !validTypes.includes(s.type)) {
-      errors.push({ path: `${path14}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
+      errors.push({ path: `${path16}.type`, message: `Step type must be one of: ${validTypes.join(", ")}` });
       continue;
     }
     if (s.requires !== void 0) {
       if (!Array.isArray(s.requires)) {
-        errors.push({ path: `${path14}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
+        errors.push({ path: `${path16}.requires`, message: '"requires" must be an array of selector strings (e.g. ["$.steps.foo.output.bar"])' });
       } else {
         for (let r = 0; r < s.requires.length; r++) {
           const sel = s.requires[r];
           if (typeof sel !== "string") {
-            errors.push({ path: `${path14}.requires[${r}]`, message: '"requires" entry must be a selector string' });
+            errors.push({ path: `${path16}.requires[${r}]`, message: '"requires" entry must be a selector string' });
           } else if (!sel.startsWith("$.")) {
-            errors.push({ path: `${path14}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
+            errors.push({ path: `${path16}.requires[${r}]`, message: `"requires" entry "${sel}" must be a selector starting with "$." (e.g. "$.steps.foo.output.bar")` });
           }
         }
       }
@@ -4587,7 +4691,7 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (s.onError && typeof s.onError === "object") {
       const oe = s.onError;
       if (!FLOW_SCHEMA.errorStrategies.includes(oe.strategy)) {
-        errors.push({ path: `${path14}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
+        errors.push({ path: `${path16}.onError.strategy`, message: `Error strategy must be one of: ${FLOW_SCHEMA.errorStrategies.join(", ")}` });
       }
     }
     const descriptor = getStepTypeDescriptor(s.type);
@@ -4597,14 +4701,14 @@ function validateStepsArray(steps, pathPrefix, errors) {
     if (!configObj || typeof configObj !== "object") {
       const hint = detectFlatConfigHint(s, descriptor);
       errors.push({
-        path: `${path14}.${configKey}`,
+        path: `${path16}.${configKey}`,
         message: `${capitalize(descriptor.type)} step must have a "${configKey}" config object${hint}`
       });
       continue;
     }
     const config2 = configObj;
     for (const [fieldName, fd] of Object.entries(descriptor.fields)) {
-      const fieldPath = `${path14}.${configKey}.${fieldName}`;
+      const fieldPath = `${path16}.${configKey}.${fieldName}`;
       const value = config2[fieldName];
       if (fd.required && (value === void 0 || value === null || value === "")) {
         errors.push({ path: fieldPath, message: `${capitalize(descriptor.type)} must have ${fd.type === "string" ? "a string" : fd.type === "array" ? "a" : "a"} "${fieldName}"` });
@@ -4637,30 +4741,30 @@ function validateStepsArray(steps, pathPrefix, errors) {
       }
     }
     if (descriptor.type === "action") {
-      validateConnectionForm(config2, `${path14}.${configKey}`, errors);
+      validateConnectionForm(config2, `${path16}.${configKey}`, errors);
     }
     if (descriptor.type === "code") {
       const hasSource = typeof config2.source === "string" && config2.source.length > 0;
       const hasModule = typeof config2.module === "string" && config2.module.length > 0;
       if (!hasSource && !hasModule) {
-        errors.push({ path: `${path14}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
+        errors.push({ path: `${path16}.${configKey}`, message: 'Code step must define either "source" (inline JS) or "module" (path to .mjs file)' });
       } else if (hasSource && hasModule) {
-        errors.push({ path: `${path14}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
+        errors.push({ path: `${path16}.${configKey}`, message: 'Code step cannot define both "source" and "module" \u2014 pick one' });
       }
       if (hasModule) {
         const m = config2.module;
         if (m.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(m)) {
-          errors.push({ path: `${path14}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
+          errors.push({ path: `${path16}.${configKey}.module`, message: "Code module path must be relative to the flow folder (no absolute paths)" });
         } else if (m.split(/[\\/]/).includes("..")) {
-          errors.push({ path: `${path14}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
+          errors.push({ path: `${path16}.${configKey}.module`, message: 'Code module path must not escape the flow folder ("..")' });
         } else if (!m.endsWith(".mjs")) {
-          errors.push({ path: `${path14}.${configKey}.module`, message: "Code module must be a .mjs file" });
+          errors.push({ path: `${path16}.${configKey}.module`, message: "Code module must be a .mjs file" });
         }
       }
       if (hasSource) {
         const syntaxError = checkCodeSourceSyntax(config2.source);
         if (syntaxError) {
-          errors.push({ path: `${path14}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
+          errors.push({ path: `${path16}.${configKey}.source`, message: `Syntax error in code step: ${syntaxError}` });
         }
       }
     }
@@ -4732,16 +4836,16 @@ function validateStepIds(flow2) {
   function collectIds(steps, pathPrefix) {
     for (let i = 0; i < steps.length; i++) {
       const step = steps[i];
-      const path14 = `${pathPrefix}[${i}]`;
+      const path16 = `${pathPrefix}[${i}]`;
       if (seen.has(step.id)) {
-        errors.push({ path: `${path14}.id`, message: `Duplicate step ID: "${step.id}"` });
+        errors.push({ path: `${path16}.id`, message: `Duplicate step ID: "${step.id}"` });
       } else {
         seen.add(step.id);
       }
       for (const { configKey, fieldName } of nestedKeys) {
         const config2 = step[configKey];
         if (config2 && Array.isArray(config2[fieldName])) {
-          collectIds(config2[fieldName], `${path14}.${configKey}.${fieldName}`);
+          collectIds(config2[fieldName], `${path16}.${configKey}.${fieldName}`);
         }
       }
     }
@@ -4789,7 +4893,7 @@ function validateSelectorReferences(flow2, rootDir) {
     }
     return selectors;
   }
-  function checkSelectors(selectors, path14, precedingStepIds) {
+  function checkSelectors(selectors, path16, precedingStepIds) {
     for (const selector of selectors) {
       const parts = selector.split(".");
       if (parts.length < 3) continue;
@@ -4797,15 +4901,15 @@ function validateSelectorReferences(flow2, rootDir) {
       if (root === "input") {
         const inputName = parts[2];
         if (!inputNames.has(inputName)) {
-          errors.push({ path: path14, message: `Selector "${selector}" references undefined input "${inputName}"` });
+          errors.push({ path: path16, message: `Selector "${selector}" references undefined input "${inputName}"` });
         }
       } else if (root === "steps") {
         const stepId = parts[2].replace(/[\[\]]/g, "").split(/[\[\]]/)[0];
         if (!allStepIds.has(stepId)) {
-          errors.push({ path: path14, message: `Selector "${selector}" references undefined step "${stepId}"` });
+          errors.push({ path: path16, message: `Selector "${selector}" references undefined step "${stepId}"` });
         } else if (precedingStepIds && !precedingStepIds.has(stepId)) {
           errors.push({
-            path: path14,
+            path: path16,
             message: `Selector "${selector}" references step "${stepId}" which is declared after the current step. Steps execute in declaration order, so this will always resolve to undefined at runtime \u2014 move the dependency earlier in the steps array.`
           });
         }
@@ -4813,20 +4917,20 @@ function validateSelectorReferences(flow2, rootDir) {
     }
   }
   const EXPRESSION_FIELDS = /* @__PURE__ */ new Set(["condition.expression", "while.condition"]);
-  function checkOperatorsInSelectorField(value, path14) {
+  function checkOperatorsInSelectorField(value, path16) {
     if (typeof value === "string" && value.startsWith("$.")) {
       if (value.includes("||")) {
-        errors.push({ path: path14, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
+        errors.push({ path: path16, message: `Selector "${value}" contains unsupported operator "||". Selectors in data fields use dot-path resolution, not JS evaluation. Use the "default" field on the input definition instead, or use a "code" step for complex expressions.` });
       } else if (value.includes("&&")) {
-        errors.push({ path: path14, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
+        errors.push({ path: path16, message: `Selector "${value}" contains unsupported operator "&&". Selectors in data fields use dot-path resolution, not JS evaluation. Use a "condition" step or "code" step for complex expressions.` });
       }
     } else if (value && typeof value === "object" && !Array.isArray(value)) {
       for (const [k, v] of Object.entries(value)) {
-        checkOperatorsInSelectorField(v, `${path14}.${k}`);
+        checkOperatorsInSelectorField(v, `${path16}.${k}`);
       }
     } else if (Array.isArray(value)) {
       for (let i = 0; i < value.length; i++) {
-        checkOperatorsInSelectorField(value[i], `${path14}[${i}]`);
+        checkOperatorsInSelectorField(value[i], `${path16}[${i}]`);
       }
     }
   }
@@ -4911,10 +5015,10 @@ var VALID_OUTPUT_SCHEMA_TYPES = /* @__PURE__ */ new Set(["string", "number", "bo
 function isOutputSchemaObject(v) {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
-function walkOutputSchema(schema, path14) {
+function walkOutputSchema(schema, path16) {
   let current = schema;
-  for (let i = 0; i < path14.length; i++) {
-    const seg = path14[i];
+  for (let i = 0; i < path16.length; i++) {
+    const seg = path16[i];
     if (typeof current === "string") {
       return current === "unknown" || current === "object" || current === "array" ? "opaque" : "opaque";
     }
@@ -6861,8 +6965,8 @@ function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function interpolate(template, record) {
-  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path14) => {
-    const parts = path14.split(".");
+  return template.replace(/\{?\{(\w+(?:\.\w+)*)\}\}?/g, (_, path16) => {
+    const parts = path16.split(".");
     let value = record;
     for (const part2 of parts) {
       if (typeof value !== "object" || value === null) return "";
@@ -6890,8 +6994,8 @@ function deepMerge(target, source) {
   }
   return result;
 }
-function getByDotPath2(obj, path14) {
-  const parts = path14.split(".");
+function getByDotPath2(obj, path16) {
+  const parts = path16.split(".");
   let current = obj;
   for (const part2 of parts) {
     if (current === null || current === void 0 || typeof current !== "object") return void 0;
@@ -6900,8 +7004,8 @@ function getByDotPath2(obj, path14) {
   return current;
 }
 function stripExcludedFields(obj, paths) {
-  for (const path14 of paths) {
-    stripOnePath(obj, path14.replace(/\[\]/g, ".*").split("."));
+  for (const path16 of paths) {
+    stripOnePath(obj, path16.replace(/\[\]/g, ".*").split("."));
   }
 }
 function stripOnePath(obj, parts) {
@@ -7322,8 +7426,8 @@ function sleep2(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 function stripFields(record, paths) {
-  for (const path14 of paths) {
-    stripOnePath2(record, path14.split("."));
+  for (const path16 of paths) {
+    stripOnePath2(record, path16.split("."));
   }
 }
 function stripOnePath2(obj, parts) {
@@ -7657,7 +7761,7 @@ async function syncModel(api, profile, options) {
             records,
             tableCreated
           ) : void 0;
-          const report = await writePageToMemory(
+          const report2 = await writePageToMemory(
             profile,
             records,
             {
@@ -7669,12 +7773,12 @@ async function syncModel(api, profile, options) {
               alreadyEnrichedIds
             }
           );
-          pageReport = report;
-          memPreserved += report.preserved;
-          for (const key of report.sourceKeysSeen) seenSourceKeys.add(key);
+          pageReport = report2;
+          memPreserved += report2.preserved;
+          for (const key of report2.sourceKeysSeen) seenSourceKeys.add(key);
           if (hasHooks && !db) {
-            inserts = report.inserts;
-            updates = report.updates;
+            inserts = report2.inserts;
+            updates = report2.updates;
           }
         } catch (err) {
           const msg = err instanceof Error ? err.message : String(err);
@@ -7993,7 +8097,7 @@ function detectColumnType2(value) {
 }
 async function testSyncProfile(api, profile) {
   const checks = [];
-  const report = {
+  const report2 = {
     platform: profile.platform,
     model: profile.model,
     ok: false,
@@ -8025,7 +8129,7 @@ async function testSyncProfile(api, profile) {
       ok: false,
       detail: err instanceof Error ? err.message : String(err)
     });
-    return report;
+    return report2;
   }
   let actionDetails;
   try {
@@ -8037,7 +8141,7 @@ async function testSyncProfile(api, profile) {
       ok: false,
       detail: err instanceof Error ? err.message : String(err)
     });
-    return report;
+    return report2;
   }
   if (actionDetails.tags?.includes("custom")) {
     checks.push({
@@ -8045,7 +8149,7 @@ async function testSyncProfile(api, profile) {
       ok: false,
       detail: `Action ${profile.actionId} is tagged "custom". Sync only supports passthrough actions. Run 'one actions find ${profile.platform} "list ${profile.model}" -t knowledge' to find one.`
     });
-    return report;
+    return report2;
   }
   let responseData;
   try {
@@ -8062,7 +8166,7 @@ async function testSyncProfile(api, profile) {
   } catch (err) {
     const detail = err instanceof ApiError ? `HTTP ${err.status}: ${err.message}` : err instanceof Error ? err.message : String(err);
     checks.push({ name: "single-page fetch", ok: false, detail });
-    return report;
+    return report2;
   }
   let resolvedResultsPath = profile.resultsPath;
   const rawCandidate = isRootPath(resolvedResultsPath) ? responseData : getByDotPath(responseData, resolvedResultsPath);
@@ -8071,8 +8175,8 @@ async function testSyncProfile(api, profile) {
     if (Array.isArray(responseData)) {
       resolvedResultsPath = "";
       records = responseData;
-      report.autoFixed = report.autoFixed ?? {};
-      report.autoFixed.resultsPath = "";
+      report2.autoFixed = report2.autoFixed ?? {};
+      report2.autoFixed.resultsPath = "";
       checks.push({
         name: `resultsPath auto-discovered \u2192 <root>`,
         ok: true,
@@ -8084,8 +8188,8 @@ async function testSyncProfile(api, profile) {
       if (arrayKey) {
         resolvedResultsPath = arrayKey;
         records = topObj[arrayKey];
-        report.autoFixed = report.autoFixed ?? {};
-        report.autoFixed.resultsPath = arrayKey;
+        report2.autoFixed = report2.autoFixed ?? {};
+        report2.autoFixed.resultsPath = arrayKey;
         checks.push({
           name: `resultsPath auto-discovered \u2192 "${arrayKey}"`,
           ok: true,
@@ -8101,7 +8205,7 @@ async function testSyncProfile(api, profile) {
       ok: false,
       detail: `Not an array. Response keys: [${topKeys.join(", ")}]`
     });
-    return report;
+    return report2;
   }
   let wrappedPrimitives = false;
   if (records.length > 0 && typeof records[0] !== "object") {
@@ -8122,8 +8226,8 @@ async function testSyncProfile(api, profile) {
   });
   if (records.length === 0) {
     checks.push({ name: "sample record available", ok: false, detail: "empty result set" });
-    report.ok = checks.every((c) => c.ok === true || c.name === "sample record available");
-    return report;
+    report2.ok = checks.every((c) => c.ok === true || c.name === "sample record available");
+    return report2;
   }
   const first = records[0];
   let resolvedIdField = profile.idField;
@@ -8137,8 +8241,8 @@ async function testSyncProfile(api, profile) {
     if (found) {
       resolvedIdField = found;
       idValue = getByDotPath(first, found);
-      report.autoFixed = report.autoFixed ?? {};
-      report.autoFixed.idField = found;
+      report2.autoFixed = report2.autoFixed ?? {};
+      report2.autoFixed.idField = found;
       checks.push({
         name: `idField auto-discovered \u2192 "${found}"`,
         ok: true,
@@ -8175,7 +8279,7 @@ async function testSyncProfile(api, profile) {
       ok: true,
       detail: JSON.stringify(nextParams).slice(0, 120)
     });
-    report.paginationPreview = nextParams;
+    report2.paginationPreview = nextParams;
   } else {
     checks.push({
       name: `pagination "${profile.pagination.type}"`,
@@ -8183,22 +8287,22 @@ async function testSyncProfile(api, profile) {
       detail: "no next page (single-page result or end-of-data)"
     });
   }
-  report.detectedColumns = Object.entries(first).map(([name, value]) => ({
+  report2.detectedColumns = Object.entries(first).map(([name, value]) => ({
     name,
     type: detectColumnType2(value)
   }));
-  report.sample = first;
-  report.samples = records.slice(0, SEARCHABLE_SAMPLE_SIZE);
-  if (profile.enrich && (profile.identityKeys?.length ?? 0) > 0 && report.samples.length > 0) {
-    const merged = await enrichOneForPreview(api, profile, report.samples[0], connectionKey);
+  report2.sample = first;
+  report2.samples = records.slice(0, SEARCHABLE_SAMPLE_SIZE);
+  if (profile.enrich && (profile.identityKeys?.length ?? 0) > 0 && report2.samples.length > 0) {
+    const merged = await enrichOneForPreview(api, profile, report2.samples[0], connectionKey);
     if (merged) {
       const preview = buildIdentityKeysPreview([merged], profile);
-      if (preview) report.identityKeysPreview = { ...preview, previewedAfterEnrich: true };
+      if (preview) report2.identityKeysPreview = { ...preview, previewedAfterEnrich: true };
     }
   }
-  report.identityKeysPreview ??= buildIdentityKeysPreview(report.samples, profile);
-  report.ok = checks.every((c) => c.ok);
-  return report;
+  report2.identityKeysPreview ??= buildIdentityKeysPreview(report2.samples, profile);
+  report2.ok = checks.every((c) => c.ok);
+  return report2;
 }
 
 // src/lib/memory/sync/infer.ts
@@ -8974,11 +9078,11 @@ function isNoise(s) {
   if (/^-?\d+(\.\d+)?([eE][-+]?\d+)?$/.test(s)) return true;
   return false;
 }
-function recordSample(stats, path14, value, jsType, recordIndex, totalSamples) {
-  let s = stats.get(path14);
+function recordSample(stats, path16, value, jsType, recordIndex, totalSamples) {
+  let s = stats.get(path16);
   if (!s) {
     s = {
-      path: path14,
+      path: path16,
       total: totalSamples,
       recordIndices: /* @__PURE__ */ new Set(),
       lenSum: 0,
@@ -8987,7 +9091,7 @@ function recordSample(stats, path14, value, jsType, recordIndex, totalSamples) {
       primaryType: jsType,
       examples: []
     };
-    stats.set(path14, s);
+    stats.set(path16, s);
   }
   s.recordIndices.add(recordIndex);
   s.lenSum += value.length;
@@ -8996,28 +9100,28 @@ function recordSample(stats, path14, value, jsType, recordIndex, totalSamples) {
   if (s.primaryType !== jsType) s.primaryType = "mixed";
   if (s.examples.length < 3 && value.length < 200) s.examples.push(value);
 }
-function walkRecord(record, path14, stats, recordIndex, totalSamples) {
+function walkRecord(record, path16, stats, recordIndex, totalSamples) {
   if (record === null || record === void 0) return;
   if (typeof record === "string") {
     const trimmed = record.trim();
-    if (trimmed) recordSample(stats, path14, trimmed, "string", recordIndex, totalSamples);
+    if (trimmed) recordSample(stats, path16, trimmed, "string", recordIndex, totalSamples);
     return;
   }
   if (typeof record === "number" || typeof record === "boolean") {
     const str = String(record);
     const kind = typeof record === "number" ? "number" : "boolean";
-    if (str) recordSample(stats, path14, str, kind, recordIndex, totalSamples);
+    if (str) recordSample(stats, path16, str, kind, recordIndex, totalSamples);
     return;
   }
   if (Array.isArray(record)) {
-    const childPath = path14 ? `${path14}[]` : "[]";
+    const childPath = path16 ? `${path16}[]` : "[]";
     for (const item of record) walkRecord(item, childPath, stats, recordIndex, totalSamples);
     return;
   }
   if (typeof record === "object") {
     for (const [key, value] of Object.entries(record)) {
       if (key.startsWith("_")) continue;
-      const childPath = path14 ? `${path14}.${key}` : key;
+      const childPath = path16 ? `${path16}.${key}` : key;
       walkRecord(value, childPath, stats, recordIndex, totalSamples);
     }
   }
@@ -9371,38 +9475,38 @@ async function syncTestCommand(platformModel, options = {}) {
     );
   }
   const api = getApi();
-  const report = await testSyncProfile(api, profile);
-  if (report.autoFixed && Object.keys(report.autoFixed).length > 0) {
+  const report2 = await testSyncProfile(api, profile);
+  if (report2.autoFixed && Object.keys(report2.autoFixed).length > 0) {
     try {
       const existing = readProfile(platform, model);
       if (existing) {
-        const patched = { ...existing, ...report.autoFixed };
+        const patched = { ...existing, ...report2.autoFixed };
         writeProfile(patched);
       }
     } catch {
     }
   }
-  const searchablePreview = options.showSearchable ? buildSearchablePreview(profile, report.samples) : null;
+  const searchablePreview = options.showSearchable ? buildSearchablePreview(profile, report2.samples) : null;
   if (isAgentMode()) {
-    json({ ...report, ...searchablePreview ? { searchable: searchablePreview } : {} });
+    json({ ...report2, ...searchablePreview ? { searchable: searchablePreview } : {} });
     return;
   }
-  for (const c of report.checks) {
+  for (const c of report2.checks) {
     const mark = c.ok ? pc11.green("\u2713") : pc11.red("\u2717");
     console.log(`  ${mark} ${c.name}${c.detail ? pc11.dim(` \u2014 ${c.detail}`) : ""}`);
   }
-  if (report.detectedColumns && report.detectedColumns.length > 0) {
+  if (report2.detectedColumns && report2.detectedColumns.length > 0) {
     console.log(`
   ${pc11.bold("Detected columns:")}`);
-    for (const col of report.detectedColumns.slice(0, 20)) {
+    for (const col of report2.detectedColumns.slice(0, 20)) {
       console.log(`    ${col.name.padEnd(30)} ${pc11.dim(col.type)}`);
     }
-    if (report.detectedColumns.length > 20) {
-      console.log(pc11.dim(`    ... and ${report.detectedColumns.length - 20} more`));
+    if (report2.detectedColumns.length > 20) {
+      console.log(pc11.dim(`    ... and ${report2.detectedColumns.length - 20} more`));
     }
   }
-  if (report.identityKeysPreview) {
-    const { perRecord, sampleKeys, entityFanOut, resolvesAfterEnrich } = report.identityKeysPreview;
+  if (report2.identityKeysPreview) {
+    const { perRecord, sampleKeys, entityFanOut, resolvesAfterEnrich } = report2.identityKeysPreview;
     const total = perRecord.reduce((a, b) => a + b, 0);
     const min = perRecord.length ? Math.min(...perRecord) : 0;
     const max = perRecord.length ? Math.max(...perRecord) : 0;
@@ -9444,7 +9548,7 @@ async function syncTestCommand(platformModel, options = {}) {
   }
   console.log(
     `
-${report.ok ? pc11.green("Profile looks good.") : pc11.red("Profile has issues.")} ` + (report.ok ? `Run: ${pc11.bold(`one sync run ${platform} --models ${model}`)}` : "Fix the issues above and test again.")
+${report2.ok ? pc11.green("Profile looks good.") : pc11.red("Profile has issues.")} ` + (report2.ok ? `Run: ${pc11.bold(`one sync run ${platform} --models ${model}`)}` : "Fix the issues above and test again.")
   );
 }
 function buildSearchablePreview(profile, samples) {
@@ -9452,7 +9556,7 @@ function buildSearchablePreview(profile, samples) {
   const first = samples[0];
   const paths = getSearchablePaths(profile);
   if (paths) {
-    const perPathAgg = paths.map((path14) => ({ path: path14, hits: 0, total: samples.length, sample: "" }));
+    const perPathAgg = paths.map((path16) => ({ path: path16, hits: 0, total: samples.length, sample: "" }));
     for (const record of samples) {
       const { paths: perPath } = extractSearchableFromPaths(record, paths);
       perPath.forEach((p9, i) => {
@@ -9720,8 +9824,8 @@ async function syncSuggestSearchableCommand(platformModel, options = {}) {
     );
   }
   const api = getApi();
-  const report = await testSyncProfile(api, profile);
-  const samples = report.samples ?? [];
+  const report2 = await testSyncProfile(api, profile);
+  const samples = report2.samples ?? [];
   if (samples.length === 0) {
     error(
       "No sample records available to rank against. Fix the failures in `sync test` first, then re-run suggest-searchable."
@@ -10409,16 +10513,16 @@ function projectEmbeddingApiKey(cfg) {
 }
 function redactSecrets(cfg) {
   const copy = JSON.parse(JSON.stringify(cfg));
-  for (const path14 of SECRET_PATHS) {
-    const val = getPath(copy, path14);
+  for (const path16 of SECRET_PATHS) {
+    const val = getPath(copy, path16);
     if (typeof val === "string" && val.length > 0) {
-      setPath(copy, path14, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
+      setPath(copy, path16, `${val.slice(0, 6)}\u2026(redacted, use --show-secrets)`);
     }
   }
   return copy;
 }
-function getPath(obj, path14) {
-  const parts = path14.split(".");
+function getPath(obj, path16) {
+  const parts = path16.split(".");
   let cur = obj;
   for (const part2 of parts) {
     if (cur == null || typeof cur !== "object") return void 0;
@@ -10426,8 +10530,8 @@ function getPath(obj, path14) {
   }
   return cur;
 }
-function setPath(obj, path14, value) {
-  const parts = path14.split(".");
+function setPath(obj, path16, value) {
+  const parts = path16.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part2 = parts[i];
@@ -10437,8 +10541,8 @@ function setPath(obj, path14, value) {
   cur[parts[parts.length - 1]] = value;
   return obj;
 }
-function unsetPath(obj, path14) {
-  const parts = path14.split(".");
+function unsetPath(obj, path16) {
+  const parts = path16.split(".");
   let cur = obj;
   for (let i = 0; i < parts.length - 1; i++) {
     const part2 = parts[i];
@@ -11411,8 +11515,9 @@ Request specific sections:
 - Always use the **exact action ID** from a find answer \u2014 don't guess
 - Always read **knowledge** before executing any action
 - Connection keys come from \`one connection list\` \u2014 don't hardcode them
-- \`connection list\` also reports an \`access\` field per connection (\`full\` / \`methods\` / \`actions\`) \u2014 read it before planning so you don't propose an action the access config will reject
+- \`connection list\` also reports an \`access\` field per connection (\`full\` / \`methods\` / \`actions\`, plus a \`level\`: full, read-write, read-only, custom, none) \u2014 what One enforces for this key, narrowed by \`one config\`. Read it before planning so you don't propose an action that will be refused. \`accessSource: "local"\` means One did not report it, so it is unverified
 - Skills stay in lockstep with the CLI version automatically \u2014 every command checks a \`.one-cli-version\` marker in the canonical skill dir and refreshes the files if the CLI has been upgraded. Check manually with \`one config skills status\`; force a resync with \`one config skills sync\`
+- Building an app whose users connect their own tools? \`one skills add connect\` (run inside the app) installs the One Connect skill from the \`@withone/connect\` version the app uses, into \`.agents/skills/one-connect\` and \`.claude/skills/one-connect\`. \`one --agent skills list\` shows what is installed; any \`one\` command in the project refreshes it after an SDK upgrade
 `;
 var GUIDE_ACTIONS = `# One Actions \u2014 Reference
 
@@ -11426,7 +11531,7 @@ Always follow this sequence. Never execute without reading the action's document
 one --agent connection list
 \`\`\`
 
-Returns platforms, status, connection keys, tags, and an \`access\` field per connection describing what the current access config lets you run there:
+Returns platforms, status, connection keys, tags, and an \`access\` field per connection: what One enforces for this key (the consent page's choices, or the dashboard's), narrowed by \`one config\`. \`access.level\` names it as the consent page does (full, read-write, read-only, custom, none):
 
 | \`access\` | Meaning |
 |----------|---------|
@@ -11434,9 +11539,9 @@ Returns platforms, status, connection keys, tags, and an \`access\` field per co
 | \`{"policy": "methods", "methods": ["GET"]}\` | Only actions with these HTTP methods will execute |
 | \`{"policy": "actions", "actions": [{"actionId", "title", "method"}]}\` | Only these exact actions \u2014 use them directly: \`actions load <actionId>\` reads their docs, no find needed |
 
-Also present when relevant: \`knowledgeOnly: true\` (execution disabled \u2014 read the docs and write code instead), \`unresolvedActionIds\` (allowlisted ids that could not be looked up), and \`accessHint\` (a one-line summary of the restriction).
+\`accessSource\` is \`server\` when One reported it, \`local\` when it could not (then it is unverified). Also present when relevant: \`knowledgeOnly: true\` (execution disabled \u2014 read the docs and write code instead), \`unresolvedActionIds\` (allowlisted ids that could not be looked up), and \`accessHint\` (a one-line summary of the restriction).
 
-Read \`access\` before planning \u2014 it prevents proposing an action the config will reject. Change it with \`one config\`.
+Read \`access\` before planning \u2014 it prevents proposing an action that will be refused. The key's access changes in the dashboard (API keys); this CLI's own limits with \`one config\`.
 
 ### 1b. Delete a Connection
 
@@ -12806,22 +12911,22 @@ function buildWorkflowIdeas(connections) {
 // src/commands/logout.ts
 import fs13 from "fs";
 import * as p8 from "@clack/prompts";
-function formatWhoami(config2, apiKey, pc16) {
+function formatWhoami(config2, apiKey, pc17) {
   const whoami = config2.whoami;
   const env = getEnvFromApiKey(apiKey);
-  const envLabel = env === "test" ? pc16.yellow("test") : pc16.green("live");
+  const envLabel = env === "test" ? pc17.yellow("test") : pc17.green("live");
   const lines = [];
   if (whoami) {
     const contextParts = [];
     if (whoami.organization) contextParts.push(whoami.organization.name);
     if (whoami.project) contextParts.push(whoami.project.name);
     const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-    lines.push(`${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`);
-    lines.push(`${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`);
-    if (config2.apiKeyName) lines.push(`${pc16.dim("Key:")} ${config2.apiKeyName}`);
+    lines.push(`${pc17.bold(scopeDisplay)} ${pc17.dim("\xB7")} ${envLabel}`);
+    lines.push(`${whoami.user.name} ${pc17.dim(`(${whoami.user.email})`)}`);
+    if (config2.apiKeyName) lines.push(`${pc17.dim("Key:")} ${config2.apiKeyName}`);
   } else {
     const keyLabel = config2.apiKeyName ?? `${apiKey.slice(0, 8)}...`;
-    lines.push(`${pc16.dim("Key:")} ${keyLabel} ${pc16.dim("\xB7")} ${envLabel}`);
+    lines.push(`${pc17.dim("Key:")} ${keyLabel} ${pc17.dim("\xB7")} ${envLabel}`);
   }
   return lines;
 }
@@ -12850,7 +12955,7 @@ async function logoutCommand() {
     json({ status: cleared ? "logged_out" : "not_logged_in", message: cleared ? "Credentials cleared." : "No config found." });
     return;
   }
-  const pc16 = (await import("picocolors")).default;
+  const pc17 = (await import("picocolors")).default;
   const globalConfig = readGlobalConfig();
   const projectConfig = readProjectConfig();
   const hasGlobal = globalConfig?.apiKey != null;
@@ -12859,13 +12964,13 @@ async function logoutCommand() {
   if (hasGlobal && hasProject) {
     const infoLines = ["You are logged in with multiple configs.", ""];
     if (projectConfig) {
-      infoLines.push(`${pc16.cyan("Local config:")}`);
-      infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc16));
+      infoLines.push(`${pc17.cyan("Local config:")}`);
+      infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc17));
       infoLines.push("");
     }
     if (globalConfig) {
-      infoLines.push(`${pc16.magenta("Global config:")}`);
-      infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc16));
+      infoLines.push(`${pc17.magenta("Global config:")}`);
+      infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc17));
     }
     p8.note(infoLines.join("\n"));
     const choice = await p8.select({
@@ -12883,14 +12988,14 @@ async function logoutCommand() {
     targetScope = choice;
   } else if (hasProject) {
     const infoLines = ["You are logged in.", ""];
-    infoLines.push(`${pc16.dim("Stored in")} ${pc16.cyan("local config")}`);
-    infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc16));
+    infoLines.push(`${pc17.dim("Stored in")} ${pc17.cyan("local config")}`);
+    infoLines.push(...formatWhoami(projectConfig, projectConfig.apiKey, pc17));
     p8.note(infoLines.join("\n"));
     targetScope = "project";
   } else if (hasGlobal) {
     const infoLines = ["You are logged in.", ""];
-    infoLines.push(`${pc16.dim("Stored in")} ${pc16.magenta("global config")}`);
-    infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc16));
+    infoLines.push(`${pc17.dim("Stored in")} ${pc17.magenta("global config")}`);
+    infoLines.push(...formatWhoami(globalConfig, globalConfig.apiKey, pc17));
     p8.note(infoLines.join("\n"));
     targetScope = "global";
   } else {
@@ -12924,6 +13029,538 @@ async function logoutCommand() {
   p8.outro("Logged out.");
 }
 
+// src/lib/project-skills.ts
+import crypto2 from "crypto";
+import fs14 from "fs";
+import os3 from "os";
+import path13 from "path";
+import zlib from "zlib";
+var OPTIONAL_SKILLS = [
+  {
+    name: "connect",
+    dirName: "one-connect",
+    title: "One Connect",
+    description: "Add One Connect to an app: your users grant it scoped, revocable access to their own tools.",
+    packageName: "@withone/connect",
+    packagePath: "skills/one-connect"
+  }
+];
+function findOptionalSkill(name) {
+  const wanted = name.trim().toLowerCase();
+  return OPTIONAL_SKILLS.find((s) => s.name === wanted || s.dirName === wanted);
+}
+var UNIVERSAL_PROJECT_DIR = ".agents/skills";
+var SKILL_AGENT_TARGETS = [
+  { id: "claude-code", name: "Claude Code", projectDir: ".claude/skills", projectMarker: null, homeDir: ".claude/skills" },
+  { id: "codex", name: "Codex", projectDir: UNIVERSAL_PROJECT_DIR, projectMarker: null, homeDir: ".codex/skills" },
+  { id: "cursor", name: "Cursor", projectDir: UNIVERSAL_PROJECT_DIR, projectMarker: null, homeDir: ".cursor/skills" },
+  { id: "amp", name: "Amp", projectDir: UNIVERSAL_PROJECT_DIR, projectMarker: null, homeDir: ".amp/skills" },
+  { id: "opencode", name: "OpenCode", projectDir: UNIVERSAL_PROJECT_DIR, projectMarker: null, homeDir: ".opencode/skills" },
+  { id: "windsurf", name: "Windsurf", projectDir: ".windsurf/skills", projectMarker: ".windsurf", homeDir: ".codeium/windsurf/skills" },
+  { id: "kiro", name: "Kiro", projectDir: ".kiro/skills", projectMarker: ".kiro", homeDir: ".kiro/skills" },
+  { id: "goose", name: "Goose", projectDir: ".goose/skills", projectMarker: ".goose", homeDir: ".config/goose/skills" },
+  { id: "roo", name: "Roo", projectDir: ".roo/skills", projectMarker: ".roo", homeDir: ".roo/skills" }
+];
+function findAgentTarget(id) {
+  return SKILL_AGENT_TARGETS.find((a) => a.id === id.trim().toLowerCase());
+}
+function findProjectRoot(start) {
+  let dir = path13.resolve(start);
+  for (; ; ) {
+    if (fs14.existsSync(path13.join(dir, "package.json")) || fs14.existsSync(path13.join(dir, ".git"))) return dir;
+    const parent = path13.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function findInstalledPackage(start, packageName) {
+  let dir = path13.resolve(start);
+  for (; ; ) {
+    const pkgDir = path13.join(dir, "node_modules", ...packageName.split("/"));
+    const manifest = path13.join(pkgDir, "package.json");
+    if (fs14.existsSync(manifest)) {
+      try {
+        const { version: version2 } = JSON.parse(fs14.readFileSync(manifest, "utf-8"));
+        if (version2) return { dir: pkgDir, version: version2 };
+      } catch {
+      }
+    }
+    const parent = path13.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+var SkillSourceError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+  }
+};
+function projectSkillSource(skill, projectDir) {
+  const installed = findInstalledPackage(projectDir, skill.packageName);
+  if (!installed) return null;
+  const dir = path13.join(installed.dir, ...skill.packagePath.split("/"));
+  if (!fs14.existsSync(path13.join(dir, "SKILL.md"))) {
+    throw new SkillSourceError(
+      `${skill.packageName} ${installed.version} does not include the ${skill.title} skill. Upgrade it: npm install ${skill.packageName}@latest`,
+      "skill-missing"
+    );
+  }
+  return { kind: "project", version: installed.version, dir, origin: installed.dir, cleanup: () => {
+  } };
+}
+function registryBase() {
+  return (process.env.ONE_SKILLS_REGISTRY || "https://registry.npmjs.org").replace(/\/+$/, "");
+}
+async function registrySkillSource(skill, fetchImpl = fetch) {
+  const metaUrl = `${registryBase()}/${skill.packageName.replace("/", "%2f")}/latest`;
+  let meta;
+  try {
+    const res = await fetchImpl(metaUrl, { headers: { accept: "application/json" } });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    meta = await res.json();
+  } catch (err) {
+    throw new SkillSourceError(`Could not reach the npm registry for ${skill.packageName} (${err.message}).`, "registry-failed");
+  }
+  const version2 = meta.version;
+  const tarball = meta.dist?.tarball;
+  const integrity = meta.dist?.integrity;
+  if (!version2 || !tarball || !integrity) {
+    throw new SkillSourceError(`The npm registry returned no tarball for ${skill.packageName}.`, "registry-failed");
+  }
+  let bytes;
+  try {
+    const res = await fetchImpl(tarball);
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    bytes = Buffer.from(await res.arrayBuffer());
+  } catch (err) {
+    throw new SkillSourceError(`Could not download ${skill.packageName}@${version2} (${err.message}).`, "registry-failed");
+  }
+  if (!matchesIntegrity(bytes, integrity)) {
+    throw new SkillSourceError(`${skill.packageName}@${version2} failed its integrity check; nothing was installed.`, "integrity");
+  }
+  const files = readTarEntries(zlib.gunzipSync(bytes), `package/${skill.packagePath}/`);
+  if (!files.some((f) => f.path === "SKILL.md")) {
+    throw new SkillSourceError(`${skill.packageName}@${version2} does not include the ${skill.title} skill.`, "not-in-package");
+  }
+  const tmp = fs14.mkdtempSync(path13.join(os3.tmpdir(), "one-skill-"));
+  for (const file of files) {
+    const dest = path13.join(tmp, ...file.path.split("/"));
+    fs14.mkdirSync(path13.dirname(dest), { recursive: true });
+    fs14.writeFileSync(dest, file.data);
+  }
+  return {
+    kind: "registry",
+    version: version2,
+    dir: tmp,
+    origin: tarball,
+    cleanup: () => {
+      try {
+        fs14.rmSync(tmp, { recursive: true, force: true });
+      } catch {
+      }
+    }
+  };
+}
+function matchesIntegrity(bytes, integrity) {
+  return integrity.split(/\s+/).some((entry) => {
+    const dash = entry.indexOf("-");
+    if (dash < 0) return false;
+    const algorithm = entry.slice(0, dash);
+    if (!["sha512", "sha384", "sha256"].includes(algorithm)) return false;
+    return crypto2.createHash(algorithm).update(bytes).digest("base64") === entry.slice(dash + 1);
+  });
+}
+function readTarEntries(tar, prefix) {
+  const out = [];
+  let offset = 0;
+  let paxPath = null;
+  const text5 = (start, length) => {
+    const raw = tar.subarray(start, start + length);
+    const end = raw.indexOf(0);
+    return raw.subarray(0, end < 0 ? raw.length : end).toString("utf-8");
+  };
+  while (offset + 512 <= tar.length) {
+    const header = tar.subarray(offset, offset + 512);
+    if (header.every((b) => b === 0)) break;
+    const size = parseInt(text5(offset + 124, 12).trim() || "0", 8);
+    const type = String.fromCharCode(header[156] || 48);
+    let name = text5(offset, 100);
+    if (text5(offset + 257, 5) === "ustar") {
+      const pre = text5(offset + 345, 155);
+      if (pre) name = `${pre}/${name}`;
+    }
+    const body = tar.subarray(offset + 512, offset + 512 + size);
+    if (type === "x") {
+      const match = /\d+ path=([^\n]*)\n/.exec(body.toString("utf-8"));
+      paxPath = match ? match[1] : null;
+    } else {
+      const full = paxPath ?? name;
+      paxPath = null;
+      if ((type === "0" || type === "\0") && full.startsWith(prefix)) {
+        const rel = full.slice(prefix.length);
+        const parts = rel.split("/");
+        if (rel && !path13.isAbsolute(rel) && !parts.includes("..") && !parts.includes("")) {
+          out.push({ path: rel, data: Buffer.from(body) });
+        }
+      }
+    }
+    offset += 512 + Math.ceil(size / 512) * 512;
+  }
+  return out;
+}
+var SKILL_STAMP = ".one-skill.json";
+function canonicalSkillDir(skill, plan) {
+  return path13.join(plan.root, ...UNIVERSAL_PROJECT_DIR.split("/"), skill.dirName);
+}
+function readStamp(dir) {
+  try {
+    return JSON.parse(fs14.readFileSync(path13.join(dir, SKILL_STAMP), "utf-8"));
+  } catch {
+    return null;
+  }
+}
+function resolveAgentFolders(plan) {
+  const explicit = plan.agents.length > 0;
+  const chosen = SKILL_AGENT_TARGETS.filter((agent) => {
+    if (explicit) return plan.agents.includes(agent.id);
+    if (plan.scope === "global") {
+      return fs14.existsSync(path13.join(plan.root, path13.dirname(agent.homeDir)));
+    }
+    return agent.projectMarker === null || fs14.existsSync(path13.join(plan.root, agent.projectMarker));
+  });
+  const readers = [];
+  const byDir = /* @__PURE__ */ new Map();
+  for (const agent of chosen) {
+    const dir = plan.scope === "project" ? agent.projectDir : agent.homeDir;
+    if (dir === UNIVERSAL_PROJECT_DIR) {
+      readers.push(agent.name);
+      continue;
+    }
+    byDir.set(dir, [...byDir.get(dir) ?? [], agent.name]);
+  }
+  return { readers, folders: [...byDir].map(([dir, agents]) => ({ dir, agents })) };
+}
+function copyDir(src, dest) {
+  fs14.mkdirSync(dest, { recursive: true });
+  for (const entry of fs14.readdirSync(src, { withFileTypes: true })) {
+    if (entry.name === SKILL_STAMP) continue;
+    const from = path13.join(src, entry.name);
+    const to = path13.join(dest, entry.name);
+    if (entry.isDirectory()) copyDir(from, to);
+    else fs14.copyFileSync(from, to);
+  }
+}
+function removePath(target) {
+  try {
+    const stat = fs14.lstatSync(target);
+    if (stat.isSymbolicLink()) fs14.unlinkSync(target);
+    else fs14.rmSync(target, { recursive: true, force: true });
+  } catch {
+  }
+}
+function linkDir(target, linkPath) {
+  removePath(linkPath);
+  fs14.mkdirSync(path13.dirname(linkPath), { recursive: true });
+  try {
+    fs14.symlinkSync(path13.relative(path13.dirname(linkPath), target), linkPath, "dir");
+    return "symlink";
+  } catch {
+  }
+  try {
+    fs14.symlinkSync(target, linkPath, "junction");
+    return "junction";
+  } catch {
+  }
+  copyDir(target, linkPath);
+  return "copy";
+}
+function installSkill(skill, source, plan, cliVersion2) {
+  const canonical = canonicalSkillDir(skill, plan);
+  const previous = readStamp(canonical);
+  const { readers, folders } = resolveAgentFolders(plan);
+  const nextPaths = new Set(folders.map((f) => `${f.dir}/${skill.dirName}`));
+  for (const link of previous?.links ?? []) {
+    if (!nextPaths.has(toPosix(link.path))) removePath(fromStamp(plan.root, link.path));
+  }
+  removePath(canonical);
+  copyDir(source.dir, canonical);
+  const links = folders.map((folder) => {
+    const rel = `${folder.dir}/${skill.dirName}`;
+    return { path: rel, kind: linkDir(canonical, fromStamp(plan.root, rel)), agents: folder.agents };
+  });
+  const stamp = {
+    skill: skill.name,
+    package: skill.packageName,
+    version: source.version,
+    source: source.kind,
+    scope: plan.scope,
+    links,
+    installedBy: `@withone/cli@${cliVersion2}`,
+    installedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  fs14.writeFileSync(path13.join(canonical, SKILL_STAMP), JSON.stringify(stamp, null, 2) + "\n");
+  return { skill, version: source.version, source: source.kind, origin: source.origin, scope: plan.scope, root: plan.root, canonical, readers, links };
+}
+function removeSkill(skill, plan) {
+  const canonical = canonicalSkillDir(skill, plan);
+  const stamp = readStamp(canonical);
+  if (!stamp && !fs14.existsSync(path13.join(canonical, "SKILL.md"))) return { removed: false, paths: [] };
+  const paths = [];
+  for (const link of stamp?.links ?? []) {
+    const full = fromStamp(plan.root, link.path);
+    if (fs14.existsSync(full) || isDanglingLink(full)) {
+      removePath(full);
+      paths.push(full);
+    }
+  }
+  removePath(canonical);
+  paths.push(canonical);
+  return { removed: true, paths };
+}
+function toPosix(p9) {
+  return p9.split("\\").join("/");
+}
+function fromStamp(root, rel) {
+  return path13.join(root, ...toPosix(rel).split("/"));
+}
+function isDanglingLink(p9) {
+  try {
+    return fs14.lstatSync(p9).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function installedSkill(skill, plan) {
+  const canonical = canonicalSkillDir(skill, plan);
+  if (!fs14.existsSync(path13.join(canonical, "SKILL.md"))) return null;
+  const stamp = readStamp(canonical);
+  return { scope: plan.scope, root: plan.root, canonical, version: stamp?.version ?? null, source: stamp?.source ?? null, links: stamp?.links ?? [] };
+}
+function globalRoot() {
+  return homeDir();
+}
+function refreshProjectSkills(cwd, cliVersion2) {
+  const root = findProjectRoot(cwd);
+  if (!root || path13.resolve(root) === path13.resolve(homeDir())) return [];
+  const results = [];
+  for (const skill of OPTIONAL_SKILLS) {
+    const canonical = canonicalSkillDir(skill, { scope: "project", root });
+    const stamp = readStamp(canonical);
+    if (!stamp || stamp.scope !== "project" || stamp.source !== "project") continue;
+    const installed = findInstalledPackage(root, skill.packageName);
+    if (!installed || installed.version === stamp.version) continue;
+    let source;
+    try {
+      source = projectSkillSource(skill, root);
+    } catch {
+      continue;
+    }
+    if (!source) continue;
+    const agents = SKILL_AGENT_TARGETS.filter((a) => stamp.links.some((l) => l.agents.includes(a.name)) || a.projectDir === UNIVERSAL_PROJECT_DIR).map((a) => a.id);
+    installSkill(skill, source, { scope: "project", root, agents }, cliVersion2);
+    results.push({ skill: skill.name, from: stamp.version, to: source.version, root });
+  }
+  return results;
+}
+
+// src/commands/skills.ts
+import path14 from "path";
+import pc16 from "picocolors";
+function requireSkill(name) {
+  const skill = findOptionalSkill(name);
+  if (!skill) {
+    const known = OPTIONAL_SKILLS.map((s) => s.name).join(", ");
+    error(`Unknown skill "${name}". Available: ${known}. The One skill itself is installed by \`one init\`.`);
+  }
+  return skill;
+}
+function parseAgents(raw) {
+  if (!raw) return [];
+  const ids = raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean);
+  for (const id of ids) {
+    if (!findAgentTarget(id)) {
+      error(`Unknown agent "${id}". Use: ${SKILL_AGENT_TARGETS.map((a) => a.id).join(", ")}.`);
+    }
+  }
+  return ids;
+}
+function resolvePlan(options) {
+  const agents = parseAgents(options.agents);
+  if (options.global) return { scope: "global", root: globalRoot(), agents };
+  const root = findProjectRoot(process.cwd());
+  if (!root || path14.resolve(root) === path14.resolve(homeDir())) {
+    error("No project here: run this inside your app (a folder with package.json or .git), or pass --global.");
+  }
+  return { scope: "project", root, agents };
+}
+async function resolveSource(skill, plan) {
+  try {
+    const local = projectSkillSource(skill, plan.scope === "project" ? plan.root : process.cwd());
+    if (local) return local;
+    return await registrySkillSource(skill);
+  } catch (err) {
+    if (err instanceof SkillSourceError) error(err.message);
+    throw err;
+  }
+}
+function display(p9, root) {
+  const rel = path14.relative(root, p9);
+  return rel && !rel.startsWith("..") ? rel : p9;
+}
+function report(command, result, packageInProject) {
+  const where = (p9) => display(p9, result.root);
+  if (isAgentMode()) {
+    json({
+      command,
+      skill: result.skill.name,
+      name: result.skill.dirName,
+      version: result.version,
+      source: { kind: result.source, from: result.origin },
+      scope: result.scope,
+      root: result.root,
+      installedTo: [
+        { path: result.canonical, kind: "folder", agents: result.readers },
+        ...result.links.map((l) => ({ path: path14.join(result.root, ...l.path.split("/")), kind: l.kind, agents: l.agents }))
+      ],
+      next: nextSteps(result, packageInProject)
+    });
+    return;
+  }
+  const scopeLabel2 = result.scope === "project" ? "this project" : "every project on this machine";
+  console.log();
+  console.log(`  ${pc16.green("\u2713")} ${pc16.bold(`${result.skill.title} skill ${result.version}`)} installed for ${scopeLabel2}`);
+  console.log();
+  const from = result.source === "project" ? `${where(result.origin)} ${pc16.dim("(the version your code uses)")}` : `npm ${pc16.dim(result.scope === "project" ? `(latest ${result.skill.packageName}; not installed in this project yet)` : `(latest ${result.skill.packageName})`)}`;
+  console.log(`  ${pc16.dim("From")}  ${from}`);
+  const rows = [
+    { path: where(result.canonical), agents: result.readers },
+    ...result.links.map((l) => ({ path: `${l.path}${l.kind === "copy" ? pc16.dim(" (copy)") : ""}`, agents: l.agents }))
+  ];
+  rows.forEach((row, i) => {
+    const agents = row.agents.length ? pc16.dim(row.agents.join(", ")) : pc16.dim("shared copy the links point to");
+    console.log(`  ${pc16.dim(i === 0 ? "To  " : "    ")}  ${row.path}  ${agents}`);
+  });
+  console.log();
+  console.log(`  ${pc16.bold("Next")}`);
+  nextSteps(result, packageInProject).forEach((step, i) => console.log(`  ${i + 1}. ${step}`));
+  console.log();
+}
+function nextSteps(result, packageInProject) {
+  const steps = [];
+  if (result.scope === "project" && !packageInProject) steps.push(`Install the SDK: npm install ${result.skill.packageName}`);
+  steps.push(`Ask your agent: "Add ${result.skill.title} to this app." The skill tells it every step.`);
+  steps.push("Set the secrets it names in your server environment yourself; never paste them into a chat.");
+  if (result.scope === "project") {
+    const folders = [`${UNIVERSAL_DIR}/${result.skill.dirName}`, ...result.links.map((l) => l.path)];
+    steps.push(`Commit ${folders.join(" and ")} so your team's agents share it. Any \`one\` command here refreshes it when ${result.skill.packageName} is upgraded.`);
+  } else {
+    steps.push(`Refresh it after a new ${result.skill.packageName} release: one skills update ${result.skill.name} --global`);
+  }
+  return steps;
+}
+var UNIVERSAL_DIR = ".agents/skills";
+async function skillsAddCommand(name, options) {
+  const skill = requireSkill(name);
+  const plan = resolvePlan(options);
+  const source = await resolveSource(skill, plan);
+  try {
+    const result = installSkill(skill, source, plan, getCurrentVersion());
+    const packageInProject = plan.scope === "project" && findInstalledPackage(plan.root, skill.packageName) !== null;
+    report("skills add", result, packageInProject);
+  } finally {
+    source.cleanup();
+  }
+}
+async function skillsUpdateCommand(name, options) {
+  const skills2 = name ? [requireSkill(name)] : OPTIONAL_SKILLS;
+  const plan = resolvePlan(options);
+  const updated = [];
+  const skipped = [];
+  for (const skill of skills2) {
+    const current = installedSkill(skill, plan);
+    if (!current) {
+      skipped.push(skill.name);
+      continue;
+    }
+    const agents = plan.agents.length ? plan.agents : SKILL_AGENT_TARGETS.filter((a) => current.links.some((l) => l.agents.includes(a.name)) || plan.scope === "project" && a.projectDir === UNIVERSAL_DIR).map((a) => a.id);
+    const source = await resolveSource(skill, plan);
+    try {
+      updated.push(installSkill(skill, source, { ...plan, agents }, getCurrentVersion()));
+    } finally {
+      source.cleanup();
+    }
+  }
+  if (name && updated.length === 0) error(`${skills2[0].title} skill is not installed here. Add it: one skills add ${skills2[0].name}${plan.scope === "global" ? " --global" : ""}`);
+  if (isAgentMode()) {
+    json({
+      command: "skills update",
+      scope: plan.scope,
+      updated: updated.map((r) => ({ skill: r.skill.name, version: r.version, source: r.source, path: r.canonical })),
+      notInstalled: skipped
+    });
+    return;
+  }
+  if (updated.length === 0) {
+    console.log("No optional skills are installed here. See: one skills list");
+    return;
+  }
+  for (const r of updated) console.log(`  ${pc16.green("\u2713")} ${r.skill.title} skill ${r.version} ${pc16.dim(display(r.canonical, r.root))}`);
+}
+async function skillsRemoveCommand(name, options) {
+  const skill = requireSkill(name);
+  const plan = resolvePlan(options);
+  const result = removeSkill(skill, plan);
+  if (isAgentMode()) {
+    json({ command: "skills remove", skill: skill.name, scope: plan.scope, removed: result.removed, paths: result.paths });
+    return;
+  }
+  if (!result.removed) {
+    console.log(`${skill.title} skill is not installed ${plan.scope === "global" ? "globally" : "in this project"}.`);
+    return;
+  }
+  console.log(`  ${pc16.green("\u2713")} Removed the ${skill.title} skill`);
+  for (const p9 of result.paths) console.log(`    ${pc16.dim(display(p9, plan.root))}`);
+}
+async function skillsListCommand() {
+  const projectRoot = findProjectRoot(process.cwd());
+  const inProject = projectRoot && path14.resolve(projectRoot) !== path14.resolve(homeDir()) ? projectRoot : null;
+  const optional = OPTIONAL_SKILLS.map((skill) => {
+    const project = inProject ? installedSkill(skill, { scope: "project", root: inProject }) : null;
+    const global = installedSkill(skill, { scope: "global", root: globalRoot() });
+    const pkg = inProject ? findInstalledPackage(inProject, skill.packageName) : null;
+    return {
+      skill: skill.name,
+      name: skill.dirName,
+      title: skill.title,
+      description: skill.description,
+      package: skill.packageName,
+      packageInProject: pkg?.version ?? null,
+      project: project ? { version: project.version, path: project.canonical, upToDate: !pkg || project.version === pkg.version } : null,
+      global: global ? { version: global.version, path: global.canonical } : null
+    };
+  });
+  const oneSkill = {
+    skill: "one",
+    title: "One CLI",
+    managedBy: "one init",
+    installed: isSkillInstalled(),
+    version: readInstalledSkillVersion()
+  };
+  if (isAgentMode()) {
+    json({ command: "skills list", project: inProject, skills: [oneSkill, ...optional] });
+    return;
+  }
+  console.log();
+  console.log(`  ${pc16.bold("one")}      ${oneSkill.installed ? pc16.green(`installed ${oneSkill.version ?? ""}`.trim()) : pc16.yellow("not installed")}  ${pc16.dim("managed by one init")}`);
+  for (const s of optional) {
+    const state = s.project ? pc16.green(`project ${s.project.version ?? ""}`.trim()) + (s.project.upToDate ? "" : pc16.yellow(` (package is ${s.packageInProject}: run one skills update ${s.skill})`)) : s.global ? pc16.green(`global ${s.global.version ?? ""}`.trim()) : pc16.dim(`not installed \u2014 one skills add ${s.skill}`);
+    console.log(`  ${pc16.bold(s.skill.padEnd(8))} ${state}`);
+    console.log(`  ${" ".repeat(8)} ${pc16.dim(s.description)}`);
+  }
+  console.log();
+}
+
 // src/cli.ts
 silenceWarningsInAgentMode();
 var require4 = createRequire3(import.meta.url);
@@ -12946,6 +13583,12 @@ program.name("one").option("--agent", "Machine-readable JSON output (no colors,
     3. one actions execute <p> <id> <key> Execute the action
        one actions load <id> --section <s> More of an action's docs: a section a digest left out, --full, or --toc
 
+  Skills for your coding agent:
+    one skills list                       The One skill and the optional ones (installed or not)
+    one skills add connect                Add the One Connect skill to this project (--global for every project)
+    one skills update [connect]           Re-copy from the installed @withone/connect after an upgrade
+    one skills remove connect             Remove it
+
   Guide:
     one guide [topic]                     Full CLI guide (topics: overview, actions, workflows, memory, sync, all)
 
@@ -13019,6 +13662,12 @@ program.hook("preAction", (thisCommand, actionCommand) => {
     } catch {
     }
   }
+  if (commandName !== "skills") {
+    try {
+      refreshProjectSkills(process.cwd(), getCurrentVersion());
+    } catch {
+    }
+  }
 });
 program.hook("postAction", async () => {
   await closeBackendIfCached();
@@ -13041,6 +13690,19 @@ program.command("login").description("Authenticate with One via browser").action
 program.command("logout").description("Clear local credentials").action(async () => {
   await logoutCommand();
 });
+var skills = program.command("skills").description("Optional skills for your coding agent, such as One Connect (the One skill itself comes from one init)");
+skills.command("list").description("Show the One skill and each optional skill, with where it is installed").action(async () => {
+  await skillsListCommand();
+});
+skills.command("add <name>").description("Install an optional skill (connect) into this project, from the SDK version it uses").option("-g, --global", "Install for every project on this machine instead").option("--agents <ids>", "Comma-separated agents to link: claude-code, codex, cursor, amp, opencode, windsurf, kiro, goose, roo").action(async (name, options) => {
+  await skillsAddCommand(name, options);
+});
+skills.command("update [name]").description("Re-copy installed optional skills from their source (all when no name is given)").option("-g, --global", "Update the global install").option("--agents <ids>", "Change which agents are linked").action(async (name, options) => {
+  await skillsUpdateCommand(name, options);
+});
+skills.command("remove <name>").alias("rm").description("Remove an optional skill and the agent folders that point at it").option("-g, --global", "Remove the global install").action(async (name, options) => {
+  await skillsRemoveCommand(name, options);
+});
 var config = program.command("config").description("Configure the CLI (access control, skills, ...)").action(async () => {
   await configCommand();
 });
@@ -13140,8 +13802,8 @@ config.command("reset").description("Remove the project config for the current d
         return;
       }
     }
-    const fs15 = await import("fs");
-    fs15.unlinkSync(globalPath);
+    const fs16 = await import("fs");
+    fs16.unlinkSync(globalPath);
     if (isAgentMode()) {
       json({ deleted: true, scope: "global" });
     } else {
@@ -13158,15 +13820,15 @@ config.command("reset").description("Remove the project config for the current d
     }
     return;
   }
-  const fs14 = await import("fs");
-  const configContent = fs14.readFileSync(resolved.path, "utf-8");
-  fs14.unlinkSync(resolved.path);
+  const fs15 = await import("fs");
+  const configContent = fs15.readFileSync(resolved.path, "utf-8");
+  fs15.unlinkSync(resolved.path);
   const next = resolveConfig();
-  fs14.mkdirSync(path13.dirname(resolved.path), { recursive: true });
-  fs14.writeFileSync(resolved.path, configContent);
+  fs15.mkdirSync(path15.dirname(resolved.path), { recursive: true });
+  fs15.writeFileSync(resolved.path, configContent);
   let fallbackLabel;
   if (next.scope === "project") {
-    fallbackLabel = `parent project config (${path13.basename(next.projectRoot)})`;
+    fallbackLabel = `parent project config (${path15.basename(next.projectRoot)})`;
   } else if (next.scope === "global") {
     fallbackLabel = "global config";
   } else {
@@ -13175,7 +13837,7 @@ config.command("reset").description("Remove the project config for the current d
   if (!isAgentMode()) {
     const p9 = await import("@clack/prompts");
     const confirmed = await p9.confirm({
-      message: `Delete project config for ${path13.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
+      message: `Delete project config for ${path15.basename(resolved.projectRoot)}? Will fall back to ${fallbackLabel}.`,
       initialValue: false
     });
     if (p9.isCancel(confirmed) || !confirmed) {
@@ -13183,9 +13845,9 @@ config.command("reset").description("Remove the project config for the current d
       return;
     }
   }
-  fs14.unlinkSync(resolved.path);
+  fs15.unlinkSync(resolved.path);
   try {
-    fs14.rmdirSync(path13.dirname(resolved.path));
+    fs15.rmdirSync(path15.dirname(resolved.path));
   } catch {
   }
   if (isAgentMode()) {
@@ -13348,22 +14010,22 @@ program.command("whoami").description("Show the user, organization, and project
     });
     return;
   }
-  const pc16 = (await import("picocolors")).default;
+  const pc17 = (await import("picocolors")).default;
   const contextParts = [];
   if (whoami.organization) contextParts.push(whoami.organization.name);
   if (whoami.project) contextParts.push(whoami.project.name);
   const scopeDisplay = contextParts.length > 0 ? contextParts.join(" / ") : "Personal";
-  const envLabel = env === "test" ? pc16.yellow("test") : pc16.green("live");
-  const configLabel = configScope === "project" ? pc16.cyan("project config") : pc16.magenta("global config");
+  const envLabel = env === "test" ? pc17.yellow("test") : pc17.green("live");
+  const configLabel = configScope === "project" ? pc17.cyan("project config") : pc17.magenta("global config");
   console.log();
-  console.log(`  ${pc16.bold(scopeDisplay)} ${pc16.dim("\xB7")} ${envLabel}`);
-  console.log(`  ${whoami.user.name} ${pc16.dim(`(${whoami.user.email})`)}`);
-  if (keyName) console.log(`  ${pc16.dim("Key:")} ${keyName}`);
-  if (whoami.organization) console.log(`  ${pc16.dim("Org:")} ${whoami.organization.name} ${pc16.dim(`(${whoami.organization.id})`)}`);
-  if (whoami.project) console.log(`  ${pc16.dim("Project:")} ${whoami.project.name} ${pc16.dim(`(${whoami.project.id})`)}`);
+  console.log(`  ${pc17.bold(scopeDisplay)} ${pc17.dim("\xB7")} ${envLabel}`);
+  console.log(`  ${whoami.user.name} ${pc17.dim(`(${whoami.user.email})`)}`);
+  if (keyName) console.log(`  ${pc17.dim("Key:")} ${keyName}`);
+  if (whoami.organization) console.log(`  ${pc17.dim("Org:")} ${whoami.organization.name} ${pc17.dim(`(${whoami.organization.id})`)}`);
+  if (whoami.project) console.log(`  ${pc17.dim("Project:")} ${whoami.project.name} ${pc17.dim(`(${whoami.project.id})`)}`);
   console.log();
-  console.log(`  ${pc16.dim("Using")} ${configLabel}`);
-  console.log(`  ${pc16.dim("API:")} ${apiBase}`);
+  console.log(`  ${pc17.dim("Using")} ${configLabel}`);
+  console.log(`  ${pc17.dim("API:")} ${apiBase}`);
   console.log();
 });
 program.command("add [platform]").description("Shortcut for: connection add").option("--tag <name>", "Tag the new connection (disambiguates multiple connections per platform in sync/flow profiles)").action(async (platform, options) => {