@withone/cli 2.4.0 → 2.6.0

package/dist/{chunk-6FA7KUNQ.js → chunk-4KX5ZERS.js}

@@ -3,21 +3,674 @@ import {
   setByDotPath
 } from "./chunk-44CV5IMX.js";
 import {
+  isAgentMode
+} from "./chunk-Q6PWTATS.js";
+import {
+  appendAnalyticsQueue,
+  appendUsageLog,
+  claimUsageLog,
+  getApiKey,
   getCacheTtl,
-  homeDir
+  getDeviceId,
+  getEnvFromApiKey,
+  getProjectRoot,
+  getWhoAmI,
+  homeDir,
+  markTelemetryNoticeShown,
+  readAnalyticsQueue,
+  readConfig,
+  readUsageState,
+  telemetryNoticeShown,
+  writeAnalyticsQueue,
+  writeUsageLog,
+  writeUsageState
 } from "./chunk-HTXZZQ6U.js";
 
 // src/lib/flow-runner.ts
-import fs3 from "fs";
-import path3 from "path";
+import fs5 from "fs";
+import path6 from "path";
 import crypto from "crypto";
 
 // src/lib/flow-engine.ts
+import fs4 from "fs";
+import os2 from "os";
+import path5 from "path";
+import { exec, spawn } from "child_process";
+import { promisify } from "util";
+
+// src/lib/install-context.ts
 import fs2 from "fs";
 import os from "os";
+import path3 from "path";
+
+// src/lib/agents.ts
+import fs from "fs";
+import path from "path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+function expandPath(p) {
+  if (p.startsWith("~/")) {
+    return path.join(homeDir(), p.slice(2));
+  }
+  return p;
+}
+function getClaudeDesktopConfigPath() {
+  switch (process.platform) {
+    case "darwin":
+      return "~/Library/Application Support/Claude/claude_desktop_config.json";
+    case "win32":
+      return path.join(process.env.APPDATA || "", "Claude", "claude_desktop_config.json");
+    default:
+      return "~/.config/Claude/claude_desktop_config.json";
+  }
+}
+function getClaudeDesktopDetectDir() {
+  switch (process.platform) {
+    case "darwin":
+      return "~/Library/Application Support/Claude";
+    case "win32":
+      return path.join(process.env.APPDATA || "", "Claude");
+    default:
+      return "~/.config/Claude";
+  }
+}
+function getWindsurfConfigPath() {
+  if (process.platform === "win32") {
+    return path.join(homeDir(), ".codeium", "windsurf", "mcp_config.json");
+  }
+  return "~/.codeium/windsurf/mcp_config.json";
+}
+function getWindsurfDetectDir() {
+  if (process.platform === "win32") {
+    return path.join(homeDir(), ".codeium", "windsurf");
+  }
+  return "~/.codeium/windsurf";
+}
+function getCursorConfigPath() {
+  if (process.platform === "win32") {
+    return path.join(homeDir(), ".cursor", "mcp.json");
+  }
+  return "~/.cursor/mcp.json";
+}
+function getAgents() {
+  return [
+    {
+      id: "claude-code",
+      name: "Claude Code",
+      configPath: "~/.claude.json",
+      configKey: "mcpServers",
+      detectDir: "~/.claude",
+      projectConfigPath: ".mcp.json"
+    },
+    {
+      id: "claude-desktop",
+      name: "Claude Desktop",
+      configPath: getClaudeDesktopConfigPath(),
+      configKey: "mcpServers",
+      detectDir: getClaudeDesktopDetectDir()
+    },
+    {
+      id: "cursor",
+      name: "Cursor",
+      configPath: getCursorConfigPath(),
+      configKey: "mcpServers",
+      detectDir: "~/.cursor",
+      projectConfigPath: ".cursor/mcp.json"
+    },
+    {
+      id: "windsurf",
+      name: "Windsurf",
+      configPath: getWindsurfConfigPath(),
+      configKey: "mcpServers",
+      detectDir: getWindsurfDetectDir()
+    },
+    {
+      id: "codex",
+      name: "Codex",
+      configPath: "~/.codex/config.toml",
+      configKey: "mcp_servers",
+      detectDir: "~/.codex",
+      projectConfigPath: ".codex/config.toml",
+      configFormat: "toml"
+    },
+    {
+      id: "kiro",
+      name: "Kiro",
+      configPath: "~/.kiro/settings/mcp.json",
+      configKey: "mcpServers",
+      detectDir: "~/.kiro",
+      projectConfigPath: ".kiro/settings/mcp.json"
+    }
+  ];
+}
+function detectInstalledAgents() {
+  return getAgents().filter((agent) => {
+    const detectDir = expandPath(agent.detectDir);
+    return fs.existsSync(detectDir);
+  });
+}
+function getAgentConfigPath(agent, scope = "global") {
+  if (scope === "project" && agent.projectConfigPath) {
+    return path.join(process.cwd(), agent.projectConfigPath);
+  }
+  return expandPath(agent.configPath);
+}
+function readAgentConfig(agent, scope = "global") {
+  const configPath = getAgentConfigPath(agent, scope);
+  if (!fs.existsSync(configPath)) {
+    return {};
+  }
+  try {
+    const content = fs.readFileSync(configPath, "utf-8");
+    if (agent.configFormat === "toml") {
+      return parseToml(content);
+    }
+    return JSON.parse(content);
+  } catch {
+    return {};
+  }
+}
+function writeAgentConfig(agent, config, scope = "global") {
+  const configPath = getAgentConfigPath(agent, scope);
+  const configDir = path.dirname(configPath);
+  if (!fs.existsSync(configDir)) {
+    fs.mkdirSync(configDir, { recursive: true });
+  }
+  if (agent.configFormat === "toml") {
+    fs.writeFileSync(configPath, stringifyToml(config));
+  } else {
+    fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+  }
+}
+function getMcpServerConfig(apiKey, accessControl) {
+  const env = {
+    ONE_SECRET: apiKey
+  };
+  if (accessControl) {
+    if (accessControl.permissions && accessControl.permissions !== "admin") {
+      env.ONE_PERMISSIONS = accessControl.permissions;
+    }
+    if (accessControl.connectionKeys && !(accessControl.connectionKeys.length === 1 && accessControl.connectionKeys[0] === "*")) {
+      env.ONE_CONNECTION_KEYS = accessControl.connectionKeys.join(",");
+    }
+    if (accessControl.actionIds && !(accessControl.actionIds.length === 1 && accessControl.actionIds[0] === "*")) {
+      env.ONE_ACTION_IDS = accessControl.actionIds.join(",");
+    }
+    if (accessControl.knowledgeAgent) {
+      env.ONE_KNOWLEDGE_AGENT = "true";
+    }
+  }
+  return {
+    command: "npx",
+    args: ["-y", "@withone/mcp"],
+    env
+  };
+}
+function installMcpConfig(agent, apiKey, scope = "global", accessControl) {
+  const config = readAgentConfig(agent, scope);
+  const configKey = agent.configKey;
+  const mcpServers = config[configKey] || {};
+  mcpServers["one"] = getMcpServerConfig(apiKey, accessControl);
+  config[configKey] = mcpServers;
+  writeAgentConfig(agent, config, scope);
+}
+function isMcpInstalled(agent, scope = "global") {
+  const config = readAgentConfig(agent, scope);
+  const configKey = agent.configKey;
+  const mcpServers = config[configKey];
+  return mcpServers?.["one"] !== void 0;
+}
+function getAgentStatuses() {
+  return getAgents().map((agent) => {
+    const detected = fs.existsSync(expandPath(agent.detectDir));
+    const globalMcp = detected && isMcpInstalled(agent, "global");
+    const projectMcp = agent.projectConfigPath ? isMcpInstalled(agent, "project") : null;
+    return { agent, detected, globalMcp, projectMcp };
+  });
+}
+
+// src/lib/analytics.ts
+import { createRequire as createRequire2 } from "module";
+import { randomUUID, createHash } from "crypto";
+import pc from "picocolors";
+
+// src/lib/version.ts
+import { createRequire } from "module";
+import { existsSync } from "fs";
 import path2 from "path";
-import { exec, spawn } from "child_process";
-import { promisify } from "util";
+import { fileURLToPath } from "url";
+var require2 = createRequire(import.meta.url);
+var cached = null;
+function cliVersion() {
+  if (cached !== null) return cached;
+  const dir = path2.dirname(fileURLToPath(import.meta.url));
+  for (let i = 1; i <= 4; i++) {
+    const candidate = path2.resolve(dir, ...Array(i).fill(".."), "package.json");
+    if (!existsSync(candidate)) continue;
+    try {
+      const version = require2(candidate).version;
+      if (version) {
+        cached = version;
+        return cached;
+      }
+    } catch {
+    }
+  }
+  cached = "unknown";
+  return cached;
+}
+
+// src/lib/analytics.ts
+var require3 = createRequire2(import.meta.url);
+var DEFAULT_POSTHOG_HOST = "https://us.i.posthog.com";
+var DEFAULT_POSTHOG_KEY = "phc_a9ok4w0uxiZcVoSWOISIlin85lHMXQD3vWPaYnuRlRV";
+var SEND_MAX_ATTEMPTS = 3;
+var QUEUE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+var EXIT_GRACE_MS = 300;
+var inFlight = /* @__PURE__ */ new Set();
+var pending = /* @__PURE__ */ new Set();
+var dispatched = /* @__PURE__ */ new Set();
+var delivered = /* @__PURE__ */ new Set();
+var UUID_SHAPE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function uuidFromInsertId(insertId) {
+  if (UUID_SHAPE.test(insertId)) return insertId.toLowerCase();
+  const h = createHash("sha1").update(`one-cli-event:${insertId}`).digest("hex");
+  const variant = (parseInt(h[16], 16) & 3 | 8).toString(16);
+  return `${h.slice(0, 8)}-${h.slice(8, 12)}-5${h.slice(13, 16)}-${variant}${h.slice(17, 20)}-${h.slice(20, 32)}`;
+}
+function posthogHost() {
+  return process.env.ONE_POSTHOG_HOST || DEFAULT_POSTHOG_HOST;
+}
+function posthogKey() {
+  return process.env.ONE_POSTHOG_KEY || DEFAULT_POSTHOG_KEY;
+}
+function envName() {
+  const key = getApiKey();
+  return key ? getEnvFromApiKey(key) : "live";
+}
+function isOn(value) {
+  return value === "1" || value === "true";
+}
+function debugLog(message) {
+  if (isOn(process.env.ONE_ANALYTICS_DEBUG)) {
+    process.stderr.write(`[analytics] ${message}
+`);
+  }
+}
+function isTelemetryDisabled() {
+  if (isOn(process.env.ONE_NO_TELEMETRY) || isOn(process.env.ONE_DISABLE_TELEMETRY)) return true;
+  if (isOn(process.env.DO_NOT_TRACK)) return true;
+  if (isOn(process.env.CI)) return true;
+  if (readConfig()?.telemetry === "off") return true;
+  return false;
+}
+function distinctId() {
+  return getWhoAmI()?.user?.id ?? getDeviceId();
+}
+function isAuthenticated() {
+  return !!getWhoAmI()?.user || !!getApiKey();
+}
+function baseProperties() {
+  return {
+    $lib: "one-cli",
+    cli_version: cliVersion(),
+    agent_mode: isAgentMode(),
+    env: envName(),
+    os: process.platform,
+    arch: process.arch,
+    node_version: process.versions.node,
+    authenticated: isAuthenticated()
+  };
+}
+function personSet() {
+  const whoami = getWhoAmI();
+  if (!whoami?.user) return void 0;
+  const set = {};
+  if (whoami.user.email) set.email = whoami.user.email;
+  if (whoami.user.name) set.name = whoami.user.name;
+  if (whoami.organization?.id) set.organization_id = whoami.organization.id;
+  return Object.keys(set).length ? set : void 0;
+}
+function send(item) {
+  const insertId = item.properties.$insert_id;
+  if (insertId) dispatched.add(insertId);
+  const controller = new AbortController();
+  inFlight.add(controller);
+  const run = (async () => {
+    try {
+      const res = await fetch(`${posthogHost()}/i/v0/e/`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+          api_key: posthogKey(),
+          event: item.event,
+          distinct_id: item.distinct_id,
+          // PostHog's dedupe key — a re-sent copy is dropped on ingest.
+          uuid: item.uuid ?? (insertId ? uuidFromInsertId(insertId) : void 0),
+          properties: item.properties,
+          timestamp: item.timestamp
+        }),
+        signal: controller.signal
+      });
+      if (res.ok && insertId) delivered.add(insertId);
+      debugLog(`"${item.event}" -> HTTP ${res.status}${res.ok ? "" : " (retry next run)"}`);
+    } catch (err) {
+      debugLog(`"${item.event}" not sent: ${err instanceof Error ? err.message : String(err)} (retry next run)`);
+    } finally {
+      inFlight.delete(controller);
+    }
+  })();
+  pending.add(run);
+  void run.finally(() => pending.delete(run));
+}
+function capture(event, properties = {}, opts = {}) {
+  if (isTelemetryDisabled()) {
+    debugLog(`disabled \u2014 skipping "${event}"`);
+    return;
+  }
+  const did = opts.distinctId ?? distinctId();
+  const props = { ...baseProperties(), ...properties };
+  if (props.$insert_id === void 0) props.$insert_id = randomUUID();
+  const insertId = props.$insert_id;
+  if (opts.personProfile === false) {
+    props.$process_person_profile = false;
+  } else if (did === distinctId()) {
+    const set = personSet();
+    if (set) props.$set = set;
+  }
+  const item = {
+    event,
+    distinct_id: did,
+    properties: props,
+    timestamp: opts.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+    uuid: uuidFromInsertId(insertId)
+  };
+  appendAnalyticsQueue(JSON.stringify(item));
+}
+var ROLLUP_WINDOW_MS = 5 * 60 * 1e3;
+var ROLLUP_MAX_BATCH = 500;
+function utcDay(ts) {
+  return new Date(ts).toISOString().slice(0, 10);
+}
+var PRE_AUTH_COMMANDS = /* @__PURE__ */ new Set([
+  "init",
+  "login",
+  "logout",
+  "guide",
+  "platforms",
+  "onboard",
+  "config",
+  "update",
+  "help"
+]);
+function shouldRecord(commandPath2) {
+  if (isAuthenticated()) return true;
+  return PRE_AUTH_COMMANDS.has(commandPath2.split(" ")[0]);
+}
+function recordCommand(command) {
+  if (isTelemetryDisabled()) {
+    writeUsageLog([]);
+    return;
+  }
+  const cmdPath = commandPath(command);
+  if (!shouldRecord(cmdPath)) return;
+  const did = distinctId();
+  const entry = { ts: Date.now(), command: cmdPath, agent: isAgentMode(), did };
+  appendUsageLog(JSON.stringify(entry));
+  const today = utcDay(entry.ts);
+  const state = readUsageState();
+  const firstTouch = state.lastDay !== today || state.distinctId !== did;
+  flushUsageRollups({ force: firstTouch });
+  if (firstTouch) writeUsageState({ lastDay: today, distinctId: did });
+}
+function flushUsageRollups(opts = {}) {
+  if (isTelemetryDisabled()) {
+    writeUsageLog([]);
+    return;
+  }
+  const lines = claimUsageLog();
+  if (!lines || lines.length === 0) return;
+  const entries = [];
+  for (const line of lines) {
+    try {
+      const e = JSON.parse(line);
+      if (e && typeof e.ts === "number" && typeof e.command === "string" && typeof e.did === "string") {
+        entries.push(e);
+      }
+    } catch {
+    }
+  }
+  if (entries.length === 0) return;
+  const currentDid = entries[entries.length - 1].did;
+  const now = Date.now();
+  const groups = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const g = groups.get(e.did);
+    if (g) g.push(e);
+    else groups.set(e.did, [e]);
+  }
+  const kept = [];
+  for (const [did, group] of groups) {
+    const due = opts.force === true || did !== currentDid || // a superseded login's batch — flush it now
+    group.length >= ROLLUP_MAX_BATCH || now - group[0].ts >= ROLLUP_WINDOW_MS;
+    if (due) emitRollup(did, group);
+    else kept.push(...group);
+  }
+  for (const e of kept) appendUsageLog(JSON.stringify(e));
+}
+function emitRollup(did, group) {
+  const byCommand = {};
+  let agentCount = 0;
+  for (const e of group) {
+    byCommand[e.command] = (byCommand[e.command] ?? 0) + 1;
+    if (e.agent) agentCount += 1;
+  }
+  const insertId = createHash("sha1").update(`${did}|${group.map((e) => `${e.ts}:${e.command}:${e.agent ? 1 : 0}`).join("|")}`).digest("hex");
+  capture(
+    "CLI Usage Rollup",
+    {
+      command_count: group.length,
+      by_command: byCommand,
+      agent_count: agentCount,
+      human_count: group.length - agentCount,
+      window_start: new Date(group[0].ts).toISOString(),
+      window_end: new Date(group[group.length - 1].ts).toISOString(),
+      $insert_id: insertId
+    },
+    {
+      distinctId: did,
+      timestamp: new Date(group[group.length - 1].ts).toISOString(),
+      // Rollups bill at the anonymous rate; the person already exists.
+      personProfile: false
+    }
+  );
+  debugLog(`rollup \u2014 ${group.length} command(s) for ${did}`);
+}
+function commandPath(command) {
+  const parts = [];
+  let current = command;
+  while (current && current.name() && current.name() !== "one") {
+    parts.unshift(current.name());
+    current = current.parent;
+  }
+  return parts.join(" ") || command.name();
+}
+function drainQueue() {
+  if (isTelemetryDisabled()) {
+    writeAnalyticsQueue([]);
+    return;
+  }
+  const now = Date.now();
+  const kept = [];
+  let changed = false;
+  for (const line of readAnalyticsQueue()) {
+    let item;
+    try {
+      item = JSON.parse(line);
+    } catch {
+      changed = true;
+      continue;
+    }
+    const insertId = item?.properties?.$insert_id;
+    if (!insertId) {
+      changed = true;
+      continue;
+    }
+    const age = now - Date.parse(item.timestamp);
+    const attempts = item.attempts ?? 0;
+    if (!(age < QUEUE_MAX_AGE_MS) || attempts >= SEND_MAX_ATTEMPTS) {
+      debugLog(`"${item.event}" dropped (${attempts} attempts, ${Math.round(age / 6e4)} min old)`);
+      changed = true;
+      continue;
+    }
+    if (dispatched.has(insertId)) {
+      kept.push(line);
+      continue;
+    }
+    item.attempts = attempts + 1;
+    if (!item.uuid) item.uuid = uuidFromInsertId(insertId);
+    kept.push(JSON.stringify(item));
+    changed = true;
+    send(item);
+  }
+  if (changed) writeAnalyticsQueue(kept);
+}
+async function flush() {
+  if (pending.size > 0) {
+    await Promise.race([
+      Promise.allSettled([...pending]),
+      new Promise((resolve2) => setTimeout(resolve2, EXIT_GRACE_MS))
+    ]);
+  }
+  for (const controller of inFlight) controller.abort();
+  const remaining = readAnalyticsQueue().filter((line) => {
+    try {
+      const item = JSON.parse(line);
+      const id = item.properties?.$insert_id;
+      if (!id || delivered.has(id)) return false;
+      return (item.attempts ?? 0) < SEND_MAX_ATTEMPTS;
+    } catch {
+      return false;
+    }
+  });
+  writeAnalyticsQueue(remaining);
+  dispatched.clear();
+  delivered.clear();
+}
+function maybeShowTelemetryNotice() {
+  if (isTelemetryDisabled() || isAgentMode()) return;
+  if (telemetryNoticeShown()) return;
+  markTelemetryNoticeShown();
+  process.stderr.write(
+    pc.dim(
+      "One CLI collects usage analytics (which commands run, linked to your One account) to improve the product.\nNo arguments, inputs, or secrets are ever collected. Opt out anytime with ONE_NO_TELEMETRY=1.\n"
+    )
+  );
+}
+
+// src/lib/install-context.ts
+var EXTRA_HARNESS_DIRS = [
+  { id: "gemini-cli", dir: ".gemini" },
+  { id: "openclaw", dir: ".openclaw" },
+  { id: "hermes", dir: ".hermes" },
+  { id: "devin", dir: ".devin" }
+];
+var LAUNCHER_ENV = [
+  { id: "claude-code", vars: ["CLAUDECODE", "CLAUDE_CODE_ENTRYPOINT"] },
+  { id: "codex", vars: ["CODEX_SANDBOX", "CODEX_CI", "CODEX_THREAD_ID"] },
+  { id: "gemini-cli", vars: ["GEMINI_CLI"] },
+  // CURSOR_TRACE_ID is deliberately absent: Cursor exports it into every
+  // integrated-terminal shell, so it marks the editor, not an agent.
+  { id: "cursor", vars: ["CURSOR_AGENT"] },
+  { id: "windsurf", vars: ["WINDSURF_AGENT"] },
+  { id: "kiro", vars: ["KIRO_AGENT"] },
+  { id: "openclaw", vars: ["OPENCLAW_AGENT", "OPENCLAW_SESSION"] },
+  { id: "hermes", vars: ["HERMES_AGENT", "HERMES_SESSION"] },
+  { id: "devin", vars: ["DEVIN_SESSION_ID"] }
+];
+function detectLauncher(env = process.env) {
+  for (const entry of LAUNCHER_ENV) {
+    if (entry.vars.some((v) => env[v] !== void 0 && env[v] !== "")) return entry.id;
+  }
+  return void 0;
+}
+function detectInstalledHarnesses() {
+  const ids = new Set(detectInstalledAgents().map((a) => a.id));
+  for (const { id, dir } of EXTRA_HARNESS_DIRS) {
+    if (fs2.existsSync(path3.join(homeDir(), dir))) ids.add(id);
+  }
+  return [...ids].sort();
+}
+function tryRead(read) {
+  try {
+    const value = read();
+    return value === null || value === "" ? void 0 : value;
+  } catch {
+    return void 0;
+  }
+}
+function collectInstallContext(opts) {
+  const env = opts.env ?? process.env;
+  const ctx = {
+    scope: opts.scope,
+    harnesses: tryRead(() => detectInstalledHarnesses()) ?? []
+  };
+  if (opts.scope === "project") {
+    ctx.path = opts.projectRoot ?? tryRead(() => getProjectRoot());
+  }
+  ctx.host = tryRead(() => os.hostname());
+  ctx.os = process.platform;
+  ctx.osVersion = tryRead(() => os.release());
+  ctx.arch = process.arch;
+  ctx.user = tryRead(() => os.userInfo().username);
+  if (!isTelemetryDisabled()) ctx.device = tryRead(() => getDeviceId());
+  const cli = tryRead(() => cliVersion());
+  ctx.cli = cli === "unknown" ? void 0 : cli;
+  ctx.launcher = detectLauncher(env);
+  return ctx;
+}
+function installContextToParams(ctx) {
+  const params = new URLSearchParams();
+  const set = (key, value) => {
+    if (value !== void 0 && value !== "") params.set(key, value);
+  };
+  set("scope", ctx.scope);
+  set("path", ctx.path);
+  set("host", ctx.host);
+  set("os", ctx.os);
+  set("osv", ctx.osVersion);
+  set("arch", ctx.arch);
+  set("user", ctx.user);
+  set("device", ctx.device);
+  set("cli", ctx.cli);
+  if (ctx.harnesses.length > 0) params.set("harnesses", ctx.harnesses.join(","));
+  set("launcher", ctx.launcher);
+  return params;
+}
+function describeInstallContext(ctx) {
+  const lines = [`scope: ${ctx.scope}`];
+  if (ctx.path) lines.push(`path: ${ctx.path}`);
+  if (ctx.host || ctx.os) {
+    const osPart = [ctx.os, ctx.osVersion].filter(Boolean).join(" ");
+    const detail = [osPart, ctx.arch].filter(Boolean).join(", ");
+    lines.push(`machine: ${ctx.host ?? "unknown"}${detail ? ` (${detail})` : ""}`);
+  }
+  if (ctx.user) lines.push(`user: ${ctx.user}`);
+  if (ctx.device) lines.push(`device: ${ctx.device}`);
+  if (ctx.harnesses.length > 0) lines.push(`harnesses: ${ctx.harnesses.join(", ")}`);
+  if (ctx.launcher) lines.push(`launched by: ${ctx.launcher}`);
+  if (ctx.cli) lines.push(`cli: ${ctx.cli}`);
+  return lines.join("\n");
+}
+
+// src/lib/caller.ts
+var CALLER_SOURCE_HEADER = "x-one-source";
+var CALLER_AGENT_HEADER = "x-one-agent";
+function callerHeaders(env = process.env) {
+  const headers = { [CALLER_SOURCE_HEADER]: "cli" };
+  const launcher = detectLauncher(env);
+  if (launcher) headers[CALLER_AGENT_HEADER] = launcher;
+  return headers;
+}
 
 // src/lib/api.ts
 import { createWriteStream } from "fs";
@@ -74,8 +727,8 @@ var OneApi = class {
     this.apiBase = apiBase ?? "https://api.withone.ai/v1";
   }
   apiBase;
-  async request(path4) {
-    return this.requestFull({ path: path4 });
+  async request(path7) {
+    return this.requestFull({ path: path7 });
   }
   async requestFull(opts) {
     let url = `${this.apiBase}${opts.path}`;
@@ -104,6 +757,20 @@ var OneApi = class {
     if (!text) return {};
     return JSON.parse(text);
   }
+  /**
+   * The calling key's own access, as One enforces it: `GET /v1/access/me`.
+   * Resolves `null` for a key with no restrictions. Throws `ApiError` when the
+   * API does not answer it (for example an older backend without the route).
+   */
+  async getOwnAccess() {
+    const body = await this.request("/access/me");
+    if (body === null) return null;
+    if (typeof body !== "object" || !("rules" in body || "methods" in body)) {
+      throw new ApiError(502, "Unexpected answer from /access/me");
+    }
+    const doc = body;
+    return { methods: doc.methods ?? null, rules: doc.rules ?? null };
+  }
   async whoami() {
     return this.request("/users/whoami");
   }
@@ -300,6 +967,9 @@ var OneApi = class {
       "x-one-action-id": action._id,
       "Content-Type": contentType,
       Accept: "application/json, text/event-stream, */*",
+      // Who is calling, for the Logs page. Before the caller's own headers so
+      // an explicit --headers value still wins.
+      ...callerHeaders(),
       ...args.headers
     };
     const finalActionPath = args.pathVariables ? replacePathVariables(action.path, args.pathVariables) : action.path;
@@ -508,9 +1178,9 @@ var TimeoutError = class extends Error {
 function sleep(ms) {
   return new Promise((resolve2) => setTimeout(resolve2, ms));
 }
-function replacePathVariables(path4, variables) {
-  if (!path4) return path4;
-  let result = path4;
+function replacePathVariables(path7, variables) {
+  if (!path7) return path7;
+  let result = path7;
   result = result.replace(/\{\{([^}]+)\}\}/g, (_match, variable) => {
     const trimmedVariable = variable.trim();
     const value = variables[trimmedVariable];
@@ -544,23 +1214,23 @@ function isActionAllowed(actionId, allowedActionIds) {
 }
 
 // src/lib/cache.ts
-import fs from "fs";
-import path from "path";
+import fs3 from "fs";
+import path4 from "path";
 function knowledgeDir() {
-  return path.join(homeDir(), ".one", "cache", "knowledge");
+  return path4.join(homeDir(), ".one", "cache", "knowledge");
 }
 function legacySearchDir() {
-  return path.join(homeDir(), ".one", "cache", "search");
+  return path4.join(homeDir(), ".one", "cache", "search");
 }
 function sanitizeFilename(input) {
   return input.replace(/[^a-zA-Z0-9_\-\.]/g, "_");
 }
 function knowledgeCachePath(actionId) {
-  return path.join(knowledgeDir(), `${sanitizeFilename(actionId)}.json`);
+  return path4.join(knowledgeDir(), `${sanitizeFilename(actionId)}.json`);
 }
 function readCache(filePath) {
   try {
-    const content = fs.readFileSync(filePath, "utf-8");
+    const content = fs3.readFileSync(filePath, "utf-8");
     return JSON.parse(content);
   } catch {
     return null;
@@ -568,9 +1238,9 @@ function readCache(filePath) {
 }
 function writeCache(filePath, entry) {
   try {
-    const dir = path.dirname(filePath);
-    fs.mkdirSync(dir, { recursive: true });
-    fs.writeFileSync(filePath, JSON.stringify(entry, null, 2));
+    const dir = path4.dirname(filePath);
+    fs3.mkdirSync(dir, { recursive: true });
+    fs3.writeFileSync(filePath, JSON.stringify(entry, null, 2));
   } catch {
   }
 }
@@ -597,9 +1267,9 @@ function formatAge(seconds) {
 function listCacheEntries() {
   const entries = [];
   try {
-    for (const file of fs.readdirSync(knowledgeDir())) {
+    for (const file of fs3.readdirSync(knowledgeDir())) {
       if (!file.endsWith(".json")) continue;
-      const filePath = path.join(knowledgeDir(), file);
+      const filePath = path4.join(knowledgeDir(), file);
       const entry = readCache(filePath);
       if (entry) {
         entries.push({ type: "knowledge", filePath, entry });
@@ -613,12 +1283,12 @@ function clearAll() {
   let count = 0;
   for (const dir of [knowledgeDir(), legacySearchDir()]) {
     try {
-      const files = fs.readdirSync(dir);
+      const files = fs3.readdirSync(dir);
       for (const file of files) {
-        fs.unlinkSync(path.join(dir, file));
+        fs3.unlinkSync(path4.join(dir, file));
         count++;
       }
-      fs.rmdirSync(dir);
+      fs3.rmdirSync(dir);
     } catch {
     }
   }
@@ -627,7 +1297,7 @@ function clearAll() {
 function clearEntry(actionId) {
   const filePath = knowledgeCachePath(actionId);
   try {
-    fs.unlinkSync(filePath);
+    fs3.unlinkSync(filePath);
     return true;
   } catch {
     return false;
@@ -655,27 +1325,27 @@ async function resolveActionDetails(api, actionId, opts = {}) {
   });
   const cachePath = knowledgeCachePath(actionId);
   const raw = useCache ? readCache(cachePath) : null;
-  const cached = isActionDetailsEntry(raw) ? raw : null;
-  if (cached && isFresh(cached)) {
-    return { details: cached.data, cacheHit: true, stale: false, entry: cached };
+  const cached2 = isActionDetailsEntry(raw) ? raw : null;
+  if (cached2 && isFresh(cached2)) {
+    return { details: cached2.data, cacheHit: true, stale: false, entry: cached2 };
   }
   try {
-    const result = await api.getActionDetailsWithMeta(actionId, cached?.etag ?? void 0);
-    if (result.status === 304 && cached) {
-      cached.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
-      writeCache(cachePath, cached);
-      return { details: cached.data, cacheHit: true, stale: false, entry: cached };
+    const result = await api.getActionDetailsWithMeta(actionId, cached2?.etag ?? void 0);
+    if (result.status === 304 && cached2) {
+      cached2.cachedAt = (/* @__PURE__ */ new Date()).toISOString();
+      writeCache(cachePath, cached2);
+      return { details: cached2.data, cacheHit: true, stale: false, entry: cached2 };
     }
     const entry = makeCacheEntry(actionId, result.data, result.etag);
     writeCache(cachePath, entry);
     return { details: result.data, cacheHit: false, stale: false, entry };
   } catch (fetchError) {
-    if (cached) {
+    if (cached2) {
       warn(
-        `Warning: serving cached action details (network unavailable, cached ${formatAge(getAge(cached))} ago)
+        `Warning: serving cached action details (network unavailable, cached ${formatAge(getAge(cached2))} ago)
 `
       );
-      return { details: cached.data, cacheHit: true, stale: true, entry: cached };
+      return { details: cached2.data, cacheHit: true, stale: true, entry: cached2 };
     }
     throw fetchError;
   }
@@ -1550,48 +2220,48 @@ function collectFileReadViolations(value, schema, basePath, out) {
   const obj = value;
   for (const [field, raw] of Object.entries(schema)) {
     const rule = asFieldSchema(raw);
-    const path4 = `${basePath}${field}`;
+    const path7 = `${basePath}${field}`;
     const present = Object.prototype.hasOwnProperty.call(obj, field) && obj[field] !== void 0;
     if (!present) {
-      if (rule.required) out.push(`field "${path4}" is required but missing`);
+      if (rule.required) out.push(`field "${path7}" is required but missing`);
       continue;
     }
-    checkFileReadRule(obj[field], rule, path4, out);
+    checkFileReadRule(obj[field], rule, path7, out);
   }
 }
-function checkFileReadRule(value, rule, path4, out) {
+function checkFileReadRule(value, rule, path7, out) {
   if (rule.type && !matchesLeafType(value, rule.type)) {
-    out.push(`field "${path4}" expected ${rule.type} but got ${actualType(value)}`);
+    out.push(`field "${path7}" expected ${rule.type} but got ${actualType(value)}`);
     return;
   }
   if (Array.isArray(rule.enum) && !rule.enum.some((e) => e === value)) {
-    out.push(`field "${path4}" value ${JSON.stringify(value)} is not one of [${rule.enum.map((e) => JSON.stringify(e)).join(", ")}]`);
+    out.push(`field "${path7}" value ${JSON.stringify(value)} is not one of [${rule.enum.map((e) => JSON.stringify(e)).join(", ")}]`);
   }
   const hasArrayConstraint = rule.items !== void 0 || rule.minItems !== void 0 || rule.maxItems !== void 0 || rule.length !== void 0;
   if (hasArrayConstraint) {
     if (!Array.isArray(value)) {
-      if (!rule.type) out.push(`field "${path4}" expected array but got ${actualType(value)}`);
+      if (!rule.type) out.push(`field "${path7}" expected array but got ${actualType(value)}`);
     } else {
       if (rule.length !== void 0 && value.length !== rule.length) {
-        out.push(`field "${path4}" expected array of length ${rule.length} but got length ${value.length}`);
+        out.push(`field "${path7}" expected array of length ${rule.length} but got length ${value.length}`);
       }
       if (rule.minItems !== void 0 && value.length < rule.minItems) {
-        out.push(`field "${path4}" expected at least ${rule.minItems} item${rule.minItems === 1 ? "" : "s"} but got ${value.length}`);
+        out.push(`field "${path7}" expected at least ${rule.minItems} item${rule.minItems === 1 ? "" : "s"} but got ${value.length}`);
       }
       if (rule.maxItems !== void 0 && value.length > rule.maxItems) {
-        out.push(`field "${path4}" expected at most ${rule.maxItems} item${rule.maxItems === 1 ? "" : "s"} but got ${value.length}`);
+        out.push(`field "${path7}" expected at most ${rule.maxItems} item${rule.maxItems === 1 ? "" : "s"} but got ${value.length}`);
       }
       if (rule.items !== void 0) {
         const itemRule = asFieldSchema(rule.items);
-        value.forEach((el, i) => checkFileReadRule(el, itemRule, `${path4}[${i}]`, out));
+        value.forEach((el, i) => checkFileReadRule(el, itemRule, `${path7}[${i}]`, out));
       }
     }
   }
   if (rule.properties) {
     if (isPlainObjectValue(value)) {
-      collectFileReadViolations(value, rule.properties, `${path4}.`, out);
+      collectFileReadViolations(value, rule.properties, `${path7}.`, out);
     } else if (!rule.type) {
-      out.push(`field "${path4}" expected object but got ${actualType(value)}`);
+      out.push(`field "${path7}" expected object but got ${actualType(value)}`);
     }
   }
 }
@@ -2069,15 +2739,15 @@ async function executeCodeModule(stepId, modulePath, context, options) {
   if (!rootDir) {
     throw new Error(`Code step "${stepId}" uses module "${modulePath}" but no flow rootDir is available. Flows that use code modules must be loaded via loadFlowWithMeta.`);
   }
-  if (path2.isAbsolute(modulePath)) {
+  if (path5.isAbsolute(modulePath)) {
     throw new Error(`Code module path must be relative to the flow root, got absolute: "${modulePath}"`);
   }
-  const absPath = path2.resolve(rootDir, modulePath);
-  const relFromRoot = path2.relative(rootDir, absPath);
-  if (relFromRoot.startsWith("..") || path2.isAbsolute(relFromRoot)) {
+  const absPath = path5.resolve(rootDir, modulePath);
+  const relFromRoot = path5.relative(rootDir, absPath);
+  if (relFromRoot.startsWith("..") || path5.isAbsolute(relFromRoot)) {
     throw new Error(`Code module "${modulePath}" resolves outside the flow directory`);
   }
-  if (!fs2.existsSync(absPath)) {
+  if (!fs4.existsSync(absPath)) {
     throw new Error(`Code module not found: ${absPath}`);
   }
   const { env: _omitEnv, ...safeContext } = context;
@@ -2225,8 +2895,8 @@ async function executeParallelStep(step, context, api, permissions, allowedActio
 function executeFileReadStep(step, context) {
   const config = step.fileRead;
   const filePath = resolveValue(config.path, context);
-  const resolvedPath = path2.resolve(filePath);
-  const content = fs2.readFileSync(resolvedPath, "utf-8");
+  const resolvedPath = path5.resolve(filePath);
+  const content = fs4.readFileSync(resolvedPath, "utf-8");
   const output = config.parseJson ? JSON.parse(stripCodeFences(content)) : content;
   if (config.parseJson && config.schema) {
     assertMatchesFileReadSchema(output, config.schema, step.id);
@@ -2237,16 +2907,16 @@ function executeFileWriteStep(step, context) {
   const config = step.fileWrite;
   const filePath = resolveValue(config.path, context);
   const content = resolveValue(config.content, context);
-  const resolvedPath = path2.resolve(filePath);
-  const dir = path2.dirname(resolvedPath);
-  if (!fs2.existsSync(dir)) {
-    fs2.mkdirSync(dir, { recursive: true });
+  const resolvedPath = path5.resolve(filePath);
+  const dir = path5.dirname(resolvedPath);
+  if (!fs4.existsSync(dir)) {
+    fs4.mkdirSync(dir, { recursive: true });
   }
   const stringContent = typeof content === "string" ? content : JSON.stringify(content, null, 2);
   if (config.append) {
-    fs2.appendFileSync(resolvedPath, stringContent);
+    fs4.appendFileSync(resolvedPath, stringContent);
   } else {
-    fs2.writeFileSync(resolvedPath, stringContent);
+    fs4.writeFileSync(resolvedPath, stringContent);
   }
   return { status: "success", output: { path: resolvedPath, bytesWritten: stringContent.length }, response: { path: resolvedPath } };
 }
@@ -2285,7 +2955,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-SFECNAO2.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-FME4AVVN.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,
@@ -2388,11 +3058,11 @@ function resolveBashEnv(envConfig, context, stepId) {
       if ("json" in obj) {
         const resolved2 = resolveValue(obj.json, context);
         const json = JSON.stringify(resolved2 ?? null);
-        const tmp = path2.join(
-          os.tmpdir(),
+        const tmp = path5.join(
+          os2.tmpdir(),
           `one-flow-${stepId}-${key}-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}.json`
         );
-        fs2.writeFileSync(tmp, json, { encoding: "utf-8" });
+        fs4.writeFileSync(tmp, json, { encoding: "utf-8" });
         tempFiles.push(tmp);
         out[key] = tmp;
         continue;
@@ -2439,7 +3109,7 @@ async function executeBashStep(step, context, options) {
   } finally {
     for (const tmp of tempFiles) {
       try {
-        fs2.unlinkSync(tmp);
+        fs4.unlinkSync(tmp);
       } catch {
       }
     }
@@ -2829,8 +3499,8 @@ var FLOWS_DIR = ".one/flows";
 var RUNS_DIR = ".one/flows/.runs";
 var LOGS_DIR = ".one/flows/.logs";
 function ensureDir(dir) {
-  if (!fs3.existsSync(dir)) {
-    fs3.mkdirSync(dir, { recursive: true });
+  if (!fs5.existsSync(dir)) {
+    fs5.mkdirSync(dir, { recursive: true });
   }
 }
 function generateRunId() {
@@ -2851,8 +3521,8 @@ var FlowRunner = class _FlowRunner {
     this.flowKey = flow.key;
     ensureDir(RUNS_DIR);
     ensureDir(LOGS_DIR);
-    this.statePath = path3.join(RUNS_DIR, `${flow.key}-${this.runId}.state.json`);
-    this.logPath = path3.join(LOGS_DIR, `${flow.key}-${this.runId}.log`);
+    this.statePath = path6.join(RUNS_DIR, `${flow.key}-${this.runId}.state.json`);
+    this.logPath = path6.join(LOGS_DIR, `${flow.key}-${this.runId}.log`);
     const resolvedInputs = { ...inputs };
     for (const [name, decl] of Object.entries(flow.inputs)) {
       if (resolvedInputs[name] === void 0 && decl.default !== void 0) {
@@ -2893,10 +3563,10 @@ var FlowRunner = class _FlowRunner {
       msg,
       ...data
     };
-    fs3.appendFileSync(this.logPath, JSON.stringify(entry) + "\n");
+    fs5.appendFileSync(this.logPath, JSON.stringify(entry) + "\n");
   }
   saveState() {
-    fs3.writeFileSync(this.statePath, JSON.stringify(this.state, stripStepsAlias, 2));
+    fs5.writeFileSync(this.statePath, JSON.stringify(this.state, stripStepsAlias, 2));
   }
   createEventHandler(externalHandler) {
     return (event) => {
@@ -2994,14 +3664,14 @@ var FlowRunner = class _FlowRunner {
   }
   /** Path to a run's persisted state file. The post-mortem artifact surfaced by `one flow inspect`. */
   static statePathFor(flowKey, runId) {
-    return path3.join(RUNS_DIR, `${flowKey}-${runId}.state.json`);
+    return path6.join(RUNS_DIR, `${flowKey}-${runId}.state.json`);
   }
   static loadRunState(runId) {
     ensureDir(RUNS_DIR);
-    const files = fs3.readdirSync(RUNS_DIR).filter((f) => f.includes(runId) && f.endsWith(".state.json"));
+    const files = fs5.readdirSync(RUNS_DIR).filter((f) => f.includes(runId) && f.endsWith(".state.json"));
     if (files.length === 0) return null;
     try {
-      const content = fs3.readFileSync(path3.join(RUNS_DIR, files[0]), "utf-8");
+      const content = fs5.readFileSync(path6.join(RUNS_DIR, files[0]), "utf-8");
       return JSON.parse(content);
     } catch {
       return null;
@@ -3013,17 +3683,17 @@ var FlowRunner = class _FlowRunner {
     runner.flowKey = state.flowKey;
     runner.state = state;
     runner.paused = false;
-    runner.statePath = path3.join(RUNS_DIR, `${state.flowKey}-${state.runId}.state.json`);
-    runner.logPath = path3.join(LOGS_DIR, `${state.flowKey}-${state.runId}.log`);
+    runner.statePath = path6.join(RUNS_DIR, `${state.flowKey}-${state.runId}.state.json`);
+    runner.logPath = path6.join(LOGS_DIR, `${state.flowKey}-${state.runId}.log`);
     return runner;
   }
   static listRuns(flowKey) {
     ensureDir(RUNS_DIR);
-    const files = fs3.readdirSync(RUNS_DIR).filter((f) => f.endsWith(".state.json"));
+    const files = fs5.readdirSync(RUNS_DIR).filter((f) => f.endsWith(".state.json"));
     const runs = [];
     for (const file of files) {
       try {
-        const content = fs3.readFileSync(path3.join(RUNS_DIR, file), "utf-8");
+        const content = fs5.readFileSync(path6.join(RUNS_DIR, file), "utf-8");
         const state = JSON.parse(content);
         if (!flowKey || state.flowKey === flowKey) {
           runs.push(state);
@@ -3036,44 +3706,44 @@ var FlowRunner = class _FlowRunner {
 };
 function resolveFlowPath(keyOrPath) {
   if (keyOrPath.endsWith(".json")) {
-    return path3.resolve(keyOrPath);
+    return path6.resolve(keyOrPath);
   }
   if (keyOrPath.includes("\\")) {
-    return path3.resolve(keyOrPath);
+    return path6.resolve(keyOrPath);
   }
   if (keyOrPath.includes("/")) {
-    const nestedFolder = path3.resolve(FLOWS_DIR, keyOrPath, "flow.json");
-    if (fs3.existsSync(nestedFolder)) return nestedFolder;
-    const literal = path3.resolve(keyOrPath);
-    if (fs3.existsSync(literal)) return literal;
+    const nestedFolder = path6.resolve(FLOWS_DIR, keyOrPath, "flow.json");
+    if (fs5.existsSync(nestedFolder)) return nestedFolder;
+    const literal = path6.resolve(keyOrPath);
+    if (fs5.existsSync(literal)) return literal;
     return nestedFolder;
   }
-  const folderPath = path3.resolve(FLOWS_DIR, keyOrPath, "flow.json");
-  if (fs3.existsSync(folderPath)) return folderPath;
-  const legacyPath = path3.resolve(FLOWS_DIR, `${keyOrPath}.flow.json`);
-  if (fs3.existsSync(legacyPath)) return legacyPath;
-  const flowsDir = path3.resolve(FLOWS_DIR);
-  if (fs3.existsSync(flowsDir)) {
-    for (const entry of fs3.readdirSync(flowsDir, { withFileTypes: true })) {
+  const folderPath = path6.resolve(FLOWS_DIR, keyOrPath, "flow.json");
+  if (fs5.existsSync(folderPath)) return folderPath;
+  const legacyPath = path6.resolve(FLOWS_DIR, `${keyOrPath}.flow.json`);
+  if (fs5.existsSync(legacyPath)) return legacyPath;
+  const flowsDir = path6.resolve(FLOWS_DIR);
+  if (fs5.existsSync(flowsDir)) {
+    for (const entry of fs5.readdirSync(flowsDir, { withFileTypes: true })) {
       if (!entry.isDirectory() || entry.name.startsWith(".")) continue;
-      const nested = path3.join(flowsDir, entry.name, keyOrPath, "flow.json");
-      if (fs3.existsSync(nested)) return nested;
+      const nested = path6.join(flowsDir, entry.name, keyOrPath, "flow.json");
+      if (fs5.existsSync(nested)) return nested;
     }
   }
   return folderPath;
 }
 function getFlowRootDir(flowFilePath) {
-  const dir = path3.dirname(flowFilePath);
-  const base = path3.basename(flowFilePath);
+  const dir = path6.dirname(flowFilePath);
+  const base = path6.basename(flowFilePath);
   if (base === "flow.json") return dir;
   return dir;
 }
 function loadFlowWithMeta(keyOrPath) {
   const filePath = resolveFlowPath(keyOrPath);
-  if (!fs3.existsSync(filePath)) {
+  if (!fs5.existsSync(filePath)) {
     throw new Error(`Flow not found: ${filePath}`);
   }
-  const content = fs3.readFileSync(filePath, "utf-8");
+  const content = fs5.readFileSync(filePath, "utf-8");
   const flow = JSON.parse(content);
   return { flow, filePath, rootDir: getFlowRootDir(filePath) };
 }
@@ -3120,13 +3790,13 @@ function summarizeFlowInputs(flow) {
   }));
 }
 function listFlows() {
-  const flowsDir = path3.resolve(FLOWS_DIR);
-  if (!fs3.existsSync(flowsDir)) return [];
+  const flowsDir = path6.resolve(FLOWS_DIR);
+  if (!fs5.existsSync(flowsDir)) return [];
   const flows = [];
   const seenKeys = /* @__PURE__ */ new Set();
   const readFlowFile = (filePath, group) => {
     try {
-      const content = fs3.readFileSync(filePath, "utf-8");
+      const content = fs5.readFileSync(filePath, "utf-8");
       const flow = JSON.parse(content);
       const nsKey = group ? `${group}/${flow.key}` : flow.key;
       if (seenKeys.has(nsKey)) return;
@@ -3138,7 +3808,7 @@ function listFlows() {
         inputCount: Object.keys(flow.inputs).length,
         stepCount: flow.steps.length,
         path: filePath,
-        layout: path3.basename(filePath) === "flow.json" ? "folder" : "legacy",
+        layout: path6.basename(filePath) === "flow.json" ? "folder" : "legacy",
         group,
         stepTypes: collectStepTypes(flow),
         requiresBash: flowRequiresBash(flow),
@@ -3149,12 +3819,12 @@ function listFlows() {
     }
   };
   const scanDir = (dir, group) => {
-    for (const entry of fs3.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs5.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name.startsWith(".")) continue;
-      const full = path3.join(dir, entry.name);
+      const full = path6.join(dir, entry.name);
       if (entry.isDirectory()) {
-        const flowJson = path3.join(full, "flow.json");
-        if (fs3.existsSync(flowJson)) {
+        const flowJson = path6.join(full, "flow.json");
+        if (fs5.existsSync(flowJson)) {
           readFlowFile(flowJson, group);
         } else {
           if (!group) {
@@ -3172,7 +3842,7 @@ function listFlows() {
 function saveFlow(flow, outputPath, group) {
   let flowPath;
   if (outputPath) {
-    flowPath = path3.resolve(outputPath);
+    flowPath = path6.resolve(outputPath);
   } else {
     let bareKey = flow.key;
     let resolvedGroup = group;
@@ -3182,25 +3852,36 @@ function saveFlow(flow, outputPath, group) {
       resolvedGroup = resolvedGroup || parts.join("/");
       flow.key = bareKey;
     }
-    const basePath = resolvedGroup ? path3.resolve(FLOWS_DIR, resolvedGroup, bareKey) : path3.resolve(FLOWS_DIR, bareKey);
-    const legacyPath = path3.resolve(FLOWS_DIR, `${bareKey}.flow.json`);
-    const folderPath = path3.join(basePath, "flow.json");
-    if (!resolvedGroup && fs3.existsSync(legacyPath) && !fs3.existsSync(folderPath)) {
+    const basePath = resolvedGroup ? path6.resolve(FLOWS_DIR, resolvedGroup, bareKey) : path6.resolve(FLOWS_DIR, bareKey);
+    const legacyPath = path6.resolve(FLOWS_DIR, `${bareKey}.flow.json`);
+    const folderPath = path6.join(basePath, "flow.json");
+    if (!resolvedGroup && fs5.existsSync(legacyPath) && !fs5.existsSync(folderPath)) {
       flowPath = legacyPath;
     } else {
       flowPath = folderPath;
     }
   }
-  const dir = path3.dirname(flowPath);
+  const dir = path6.dirname(flowPath);
   ensureDir(dir);
-  if (path3.basename(flowPath) === "flow.json") {
-    ensureDir(path3.join(dir, "lib"));
+  if (path6.basename(flowPath) === "flow.json") {
+    ensureDir(path6.join(dir, "lib"));
   }
-  fs3.writeFileSync(flowPath, JSON.stringify(flow, null, 2) + "\n");
+  fs5.writeFileSync(flowPath, JSON.stringify(flow, null, 2) + "\n");
   return flowPath;
 }
 
 export {
+  installMcpConfig,
+  getAgentStatuses,
+  cliVersion,
+  recordCommand,
+  flushUsageRollups,
+  drainQueue,
+  flush,
+  maybeShowTelemetryNotice,
+  collectInstallContext,
+  installContextToParams,
+  describeInstallContext,
   ApiError,
   OneApi,
   TimeoutError,