@picahq/cli 1.6.0 → 1.8.0

package/README.md

@@ -46,6 +46,7 @@ If you already have a config, `pica init` shows your current setup instead of st
   Cursor          ○ no    ○ no
   Windsurf        -       -
   Codex           ● yes   ○ no
+  Kiro            ○ no    ○ no
 
   - = not detected on this machine
 ```
@@ -54,7 +55,7 @@ Then it offers targeted actions based on what's missing:
 
 - **Update API key** -- validates the new key, then re-installs to every agent that currently has the MCP (preserving global/project scopes)
 - **Install MCP to more agents** -- only shows detected agents missing the MCP
-- **Install MCP for this project** -- creates `.mcp.json` / `.cursor/mcp.json` / `.codex/config.toml` in cwd for agents that support project scope
+- **Install MCP for this project** -- creates `.mcp.json` / `.cursor/mcp.json` / `.codex/config.toml` / `.kiro/settings/mcp.json` in cwd for agents that support project scope
 - **Start fresh** -- full setup flow from scratch
 
 Options that don't apply are hidden. If every detected agent already has the MCP globally, "Install MCP to more agents" won't appear.
@@ -130,6 +131,7 @@ All API calls route through Pica's passthrough proxy (`api.picaos.com/v1/passthr
 | Cursor | `~/.cursor/mcp.json` | `.cursor/mcp.json` |
 | Windsurf | `~/.codeium/windsurf/mcp_config.json` | n/a |
 | Codex | `~/.codex/config.toml` | `.codex/config.toml` |
+| Kiro | `~/.kiro/settings/mcp.json` | `.kiro/settings/mcp.json` |
 
 Global installs make the MCP available everywhere. Project installs create config files in your current directory that can be committed and shared with your team (each team member needs their own API key).
 

package/dist/index.js

@@ -5,8 +5,8 @@ import { createRequire } from "module";
 import { Command } from "commander";
 
 // src/commands/init.ts
-import * as p from "@clack/prompts";
-import pc2 from "picocolors";
+import * as p2 from "@clack/prompts";
+import pc3 from "picocolors";
 
 // src/lib/config.ts
 import fs from "fs";
@@ -41,17 +41,43 @@ function getApiKey() {
   const config = readConfig();
   return config?.apiKey ?? null;
 }
+function getAccessControl() {
+  return readConfig()?.accessControl ?? {};
+}
+function updateAccessControl(settings) {
+  const config = readConfig();
+  if (!config) return;
+  const cleaned = {};
+  if (settings.permissions && settings.permissions !== "admin") {
+    cleaned.permissions = settings.permissions;
+  }
+  if (settings.connectionKeys && !(settings.connectionKeys.length === 1 && settings.connectionKeys[0] === "*")) {
+    cleaned.connectionKeys = settings.connectionKeys;
+  }
+  if (settings.actionIds && !(settings.actionIds.length === 1 && settings.actionIds[0] === "*")) {
+    cleaned.actionIds = settings.actionIds;
+  }
+  if (settings.knowledgeAgent) {
+    cleaned.knowledgeAgent = true;
+  }
+  if (Object.keys(cleaned).length === 0) {
+    delete config.accessControl;
+  } else {
+    config.accessControl = cleaned;
+  }
+  writeConfig(config);
+}
 
 // src/lib/agents.ts
 import fs2 from "fs";
 import path2 from "path";
 import os2 from "os";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-function expandPath(p4) {
-  if (p4.startsWith("~/")) {
-    return path2.join(os2.homedir(), p4.slice(2));
+function expandPath(p5) {
+  if (p5.startsWith("~/")) {
+    return path2.join(os2.homedir(), p5.slice(2));
   }
-  return p4;
+  return p5;
 }
 function getClaudeDesktopConfigPath() {
   switch (process.platform) {
@@ -130,6 +156,14 @@ var AGENTS = [
     detectDir: "~/.codex",
     projectConfigPath: ".codex/config.toml",
     configFormat: "toml"
+  },
+  {
+    id: "kiro",
+    name: "Kiro",
+    configPath: "~/.kiro/settings/mcp.json",
+    configKey: "mcpServers",
+    detectDir: "~/.kiro",
+    projectConfigPath: ".kiro/settings/mcp.json"
   }
 ];
 function getAllAgents() {
@@ -171,20 +205,35 @@ function writeAgentConfig(agent, config, scope = "global") {
     fs2.writeFileSync(configPath, JSON.stringify(config, null, 2));
   }
 }
-function getMcpServerConfig(apiKey) {
+function getMcpServerConfig(apiKey, accessControl) {
+  const env = {
+    PICA_SECRET: apiKey
+  };
+  if (accessControl) {
+    if (accessControl.permissions && accessControl.permissions !== "admin") {
+      env.PICA_PERMISSIONS = accessControl.permissions;
+    }
+    if (accessControl.connectionKeys && !(accessControl.connectionKeys.length === 1 && accessControl.connectionKeys[0] === "*")) {
+      env.PICA_CONNECTION_KEYS = accessControl.connectionKeys.join(",");
+    }
+    if (accessControl.actionIds && !(accessControl.actionIds.length === 1 && accessControl.actionIds[0] === "*")) {
+      env.PICA_ACTION_IDS = accessControl.actionIds.join(",");
+    }
+    if (accessControl.knowledgeAgent) {
+      env.PICA_KNOWLEDGE_AGENT = "true";
+    }
+  }
   return {
     command: "npx",
     args: ["-y", "@picahq/mcp"],
-    env: {
-      PICA_SECRET: apiKey
-    }
+    env
   };
 }
-function installMcpConfig(agent, apiKey, scope = "global") {
+function installMcpConfig(agent, apiKey, scope = "global", accessControl) {
   const config = readAgentConfig(agent, scope);
   const configKey = agent.configKey;
   const mcpServers = config[configKey] || {};
-  mcpServers["pica"] = getMcpServerConfig(apiKey);
+  mcpServers["pica"] = getMcpServerConfig(apiKey, accessControl);
   config[configKey] = mcpServers;
   writeAgentConfig(agent, config, scope);
 }
@@ -239,8 +288,8 @@ var PicaApi = class {
     }
     const response = await fetch(url, fetchOpts);
     if (!response.ok) {
-      const text3 = await response.text();
-      throw new ApiError(response.status, text3 || `HTTP ${response.status}`);
+      const text4 = await response.text();
+      throw new ApiError(response.status, text4 || `HTTP ${response.status}`);
     }
     return response.json();
   }
@@ -316,11 +365,171 @@ async function openApiKeyPage() {
   await open(getApiKeyUrl());
 }
 
+// src/commands/config.ts
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+async function configCommand() {
+  const config = readConfig();
+  if (!config) {
+    p.log.error(`No Pica config found. Run ${pc.cyan("pica init")} first.`);
+    return;
+  }
+  p.intro(pc.bgCyan(pc.black(" Pica Access Control ")));
+  const current = getAccessControl();
+  console.log();
+  console.log(`  ${pc.bold("Current Access Control")}`);
+  console.log(`  ${pc.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc.dim("Permissions:")}   ${current.permissions ?? "admin"}`);
+  console.log(`  ${pc.dim("Connections:")}   ${formatList(current.connectionKeys)}`);
+  console.log(`  ${pc.dim("Action IDs:")}    ${formatList(current.actionIds)}`);
+  console.log(`  ${pc.dim("Knowledge only:")} ${current.knowledgeAgent ? "yes" : "no"}`);
+  console.log();
+  const permissions = await p.select({
+    message: "Permission level",
+    options: [
+      { value: "admin", label: "Admin", hint: "Full access (GET, POST, PUT, PATCH, DELETE)" },
+      { value: "write", label: "Write", hint: "GET, POST, PUT, PATCH" },
+      { value: "read", label: "Read", hint: "GET only" }
+    ],
+    initialValue: current.permissions ?? "admin"
+  });
+  if (p.isCancel(permissions)) {
+    p.outro("No changes made.");
+    return;
+  }
+  const connectionMode = await p.select({
+    message: "Connection scope",
+    options: [
+      { value: "all", label: "All connections" },
+      { value: "specific", label: "Select specific connections" }
+    ],
+    initialValue: current.connectionKeys ? "specific" : "all"
+  });
+  if (p.isCancel(connectionMode)) {
+    p.outro("No changes made.");
+    return;
+  }
+  let connectionKeys;
+  if (connectionMode === "specific") {
+    connectionKeys = await selectConnections(config.apiKey);
+    if (connectionKeys === void 0) {
+      p.outro("No changes made.");
+      return;
+    }
+    if (connectionKeys.length === 0) {
+      p.log.info(`No connections found. Defaulting to all. Use ${pc.cyan("pica add")} to connect platforms.`);
+      connectionKeys = void 0;
+    }
+  }
+  const actionMode = await p.select({
+    message: "Action scope",
+    options: [
+      { value: "all", label: "All actions" },
+      { value: "specific", label: "Restrict to specific action IDs" }
+    ],
+    initialValue: current.actionIds ? "specific" : "all"
+  });
+  if (p.isCancel(actionMode)) {
+    p.outro("No changes made.");
+    return;
+  }
+  let actionIds;
+  if (actionMode === "specific") {
+    const actionInput = await p.text({
+      message: "Enter action IDs (comma-separated):",
+      placeholder: "action-id-1, action-id-2",
+      initialValue: current.actionIds?.join(", ") ?? "",
+      validate: (value) => {
+        if (!value.trim()) return "At least one action ID is required";
+        return void 0;
+      }
+    });
+    if (p.isCancel(actionInput)) {
+      p.outro("No changes made.");
+      return;
+    }
+    actionIds = actionInput.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  const knowledgeAgent = await p.confirm({
+    message: "Enable knowledge-only mode? (disables action execution)",
+    initialValue: current.knowledgeAgent ?? false
+  });
+  if (p.isCancel(knowledgeAgent)) {
+    p.outro("No changes made.");
+    return;
+  }
+  const settings = {
+    permissions,
+    connectionKeys: connectionKeys ?? ["*"],
+    actionIds: actionIds ?? ["*"],
+    knowledgeAgent
+  };
+  updateAccessControl(settings);
+  const ac = getAccessControl();
+  const statuses = getAgentStatuses();
+  const reinstalled = [];
+  for (const s of statuses) {
+    if (s.globalMcp) {
+      installMcpConfig(s.agent, config.apiKey, "global", ac);
+      reinstalled.push(`${s.agent.name} (global)`);
+    }
+    if (s.projectMcp) {
+      installMcpConfig(s.agent, config.apiKey, "project", ac);
+      reinstalled.push(`${s.agent.name} (project)`);
+    }
+  }
+  if (reinstalled.length > 0) {
+    p.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
+  }
+  p.outro("Access control updated.");
+}
+async function selectConnections(apiKey) {
+  const spinner5 = p.spinner();
+  spinner5.start("Fetching connections...");
+  let connections;
+  try {
+    const api = new PicaApi(apiKey);
+    const rawConnections = await api.listConnections();
+    connections = rawConnections.map((c) => ({ platform: c.platform, key: c.key }));
+    spinner5.stop(`Found ${connections.length} connection(s)`);
+  } catch {
+    spinner5.stop("Could not fetch connections");
+    const manual = await p.text({
+      message: "Enter connection keys manually (comma-separated):",
+      placeholder: "conn_key_1, conn_key_2",
+      validate: (value) => {
+        if (!value.trim()) return "At least one connection key is required";
+        return void 0;
+      }
+    });
+    if (p.isCancel(manual)) return void 0;
+    return manual.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  if (connections.length === 0) {
+    return [];
+  }
+  const selected = await p.multiselect({
+    message: "Select connections:",
+    options: connections.map((c) => ({
+      value: c.key,
+      label: `${c.platform}`,
+      hint: c.key
+    }))
+  });
+  if (p.isCancel(selected)) return void 0;
+  return selected;
+}
+function formatList(list) {
+  if (!list || list.length === 0) return "all";
+  if (list.length === 1 && list[0] === "*") return "all";
+  return list.join(", ");
+}
+
 // src/commands/init.ts
 import open2 from "open";
 
 // src/lib/table.ts
-import pc from "picocolors";
+import pc2 from "picocolors";
 function printTable(columns, rows) {
   if (rows.length === 0) return;
   const gap = "  ";
@@ -332,10 +541,10 @@ function printTable(columns, rows) {
   });
   const header = columns.map((col, i) => {
     const padded = col.align === "right" ? col.label.padStart(widths[i]) : col.label.padEnd(widths[i]);
-    return pc.dim(padded);
+    return pc2.dim(padded);
   }).join(gap);
   console.log(`${indent}${header}`);
-  const separator = columns.map((_, i) => pc.dim("\u2500".repeat(widths[i]))).join(gap);
+  const separator = columns.map((_, i) => pc2.dim("\u2500".repeat(widths[i]))).join(gap);
   console.log(`${indent}${separator}`);
   for (const row of rows) {
     const line = columns.map((col, i) => {
@@ -359,7 +568,7 @@ function stripAnsi(str) {
 async function initCommand(options) {
   const existingConfig = readConfig();
   if (existingConfig) {
-    p.intro(pc2.bgCyan(pc2.black(" Pica ")));
+    p2.intro(pc3.bgCyan(pc3.black(" Pica ")));
     await handleExistingConfig(existingConfig.apiKey, options);
     return;
   }
@@ -370,10 +579,10 @@ async function handleExistingConfig(apiKey, options) {
   const statuses = getAgentStatuses();
   const masked = maskApiKey(apiKey);
   console.log();
-  console.log(`  ${pc2.bold("Current Setup")}`);
-  console.log(`  ${pc2.dim("\u2500".repeat(42))}`);
-  console.log(`  ${pc2.dim("API Key:")}  ${masked}`);
-  console.log(`  ${pc2.dim("Config:")}   ${getConfigPath()}`);
+  console.log(`  ${pc3.bold("Current Setup")}`);
+  console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc3.dim("API Key:")}  ${masked}`);
+  console.log(`  ${pc3.dim("Config:")}   ${getConfigPath()}`);
   console.log();
   printTable(
     [
@@ -383,15 +592,24 @@ async function handleExistingConfig(apiKey, options) {
     ],
     statuses.map((s) => ({
       agent: s.agent.name,
-      global: !s.detected ? pc2.dim("-") : s.globalMcp ? pc2.green("\u25CF yes") : pc2.yellow("\u25CB no"),
-      project: s.projectMcp === null ? pc2.dim("-") : s.projectMcp ? pc2.green("\u25CF yes") : pc2.yellow("\u25CB no")
+      global: !s.detected ? pc3.dim("-") : s.globalMcp ? pc3.green("\u25CF yes") : pc3.yellow("\u25CB no"),
+      project: s.projectMcp === null ? pc3.dim("-") : s.projectMcp ? pc3.green("\u25CF yes") : pc3.yellow("\u25CB no")
     }))
   );
   const notDetected = statuses.filter((s) => !s.detected);
   if (notDetected.length > 0) {
-    console.log(`  ${pc2.dim("- = not detected on this machine")}`);
+    console.log(`  ${pc3.dim("- = not detected on this machine")}`);
+  }
+  const ac = getAccessControl();
+  if (Object.keys(ac).length > 0) {
+    console.log(`  ${pc3.bold("Access Control")}`);
+    console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
+    if (ac.permissions) console.log(`  ${pc3.dim("Permissions:")}   ${ac.permissions}`);
+    if (ac.connectionKeys) console.log(`  ${pc3.dim("Connections:")}   ${ac.connectionKeys.join(", ")}`);
+    if (ac.actionIds) console.log(`  ${pc3.dim("Action IDs:")}    ${ac.actionIds.join(", ")}`);
+    if (ac.knowledgeAgent) console.log(`  ${pc3.dim("Knowledge only:")} yes`);
+    console.log();
   }
-  console.log();
   const actionOptions = [];
   actionOptions.push({
     value: "update-key",
@@ -413,16 +631,21 @@ async function handleExistingConfig(apiKey, options) {
       hint: agentsMissingProject.map((s) => s.agent.name).join(", ")
     });
   }
+  actionOptions.push({
+    value: "access-control",
+    label: "Configure access control",
+    hint: "permissions, connections, actions"
+  });
   actionOptions.push({
     value: "start-fresh",
     label: "Start fresh (reconfigure everything)"
   });
-  const action = await p.select({
+  const action = await p2.select({
     message: "What would you like to do?",
     options: actionOptions
   });
-  if (p.isCancel(action)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(action)) {
+    p2.outro("No changes made.");
     return;
   }
   switch (action) {
@@ -435,26 +658,29 @@ async function handleExistingConfig(apiKey, options) {
     case "install-project":
       await handleInstallProject(apiKey, agentsMissingProject);
       break;
+    case "access-control":
+      await configCommand();
+      break;
     case "start-fresh":
       await freshSetup({ yes: true });
       break;
   }
 }
 async function handleUpdateKey(statuses) {
-  p.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, "API Key");
-  const openBrowser = await p.confirm({
+  p2.note(`Get your API key at:
+${pc3.cyan(getApiKeyUrl())}`, "API Key");
+  const openBrowser = await p2.confirm({
     message: "Open browser to get API key?",
     initialValue: true
   });
-  if (p.isCancel(openBrowser)) {
-    p.cancel("Cancelled.");
+  if (p2.isCancel(openBrowser)) {
+    p2.cancel("Cancelled.");
     process.exit(0);
   }
   if (openBrowser) {
     await openApiKeyPage();
   }
-  const newKey = await p.text({
+  const newKey = await p2.text({
     message: "Enter your new Pica API key:",
     placeholder: "sk_live_...",
     validate: (value) => {
@@ -465,28 +691,29 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       return void 0;
     }
   });
-  if (p.isCancel(newKey)) {
-    p.cancel("Cancelled.");
+  if (p2.isCancel(newKey)) {
+    p2.cancel("Cancelled.");
     process.exit(0);
   }
-  const spinner4 = p.spinner();
-  spinner4.start("Validating API key...");
+  const spinner5 = p2.spinner();
+  spinner5.start("Validating API key...");
   const api = new PicaApi(newKey);
   const isValid = await api.validateApiKey();
   if (!isValid) {
-    spinner4.stop("Invalid API key");
-    p.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+    spinner5.stop("Invalid API key");
+    p2.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
     process.exit(1);
   }
-  spinner4.stop("API key validated");
+  spinner5.stop("API key validated");
+  const ac = getAccessControl();
   const reinstalled = [];
   for (const s of statuses) {
     if (s.globalMcp) {
-      installMcpConfig(s.agent, newKey, "global");
+      installMcpConfig(s.agent, newKey, "global", ac);
       reinstalled.push(`${s.agent.name} (global)`);
     }
     if (s.projectMcp) {
-      installMcpConfig(s.agent, newKey, "project");
+      installMcpConfig(s.agent, newKey, "project", ac);
       reinstalled.push(`${s.agent.name} (project)`);
     }
   }
@@ -494,108 +721,111 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
   writeConfig({
     apiKey: newKey,
     installedAgents: config?.installedAgents ?? [],
-    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    accessControl: config?.accessControl
   });
   if (reinstalled.length > 0) {
-    p.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
+    p2.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
   }
-  p.outro("API key updated.");
+  p2.outro("API key updated.");
 }
 async function handleInstallMore(apiKey, missing) {
+  const ac = getAccessControl();
   if (missing.length === 1) {
     const agent = missing[0].agent;
-    const confirm2 = await p.confirm({
+    const confirm3 = await p2.confirm({
       message: `Install Pica MCP to ${agent.name}?`,
       initialValue: true
     });
-    if (p.isCancel(confirm2) || !confirm2) {
-      p.outro("No changes made.");
+    if (p2.isCancel(confirm3) || !confirm3) {
+      p2.outro("No changes made.");
       return;
     }
-    installMcpConfig(agent, apiKey, "global");
+    installMcpConfig(agent, apiKey, "global", ac);
     updateConfigAgents(agent.id);
-    p.log.success(`${agent.name}: MCP installed`);
-    p.outro("Done.");
+    p2.log.success(`${agent.name}: MCP installed`);
+    p2.outro("Done.");
     return;
   }
-  const selected = await p.multiselect({
+  const selected = await p2.multiselect({
     message: "Select agents to install MCP:",
     options: missing.map((s) => ({
       value: s.agent.id,
       label: s.agent.name
     }))
   });
-  if (p.isCancel(selected)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(selected)) {
+    p2.outro("No changes made.");
     return;
   }
   const agents = missing.filter((s) => selected.includes(s.agent.id));
   for (const s of agents) {
-    installMcpConfig(s.agent, apiKey, "global");
+    installMcpConfig(s.agent, apiKey, "global", ac);
     updateConfigAgents(s.agent.id);
-    p.log.success(`${s.agent.name}: MCP installed`);
+    p2.log.success(`${s.agent.name}: MCP installed`);
   }
-  p.outro("Done.");
+  p2.outro("Done.");
 }
 async function handleInstallProject(apiKey, missing) {
+  const ac = getAccessControl();
   if (missing.length === 1) {
     const agent = missing[0].agent;
-    const confirm2 = await p.confirm({
+    const confirm3 = await p2.confirm({
       message: `Install project-level MCP for ${agent.name}?`,
       initialValue: true
     });
-    if (p.isCancel(confirm2) || !confirm2) {
-      p.outro("No changes made.");
+    if (p2.isCancel(confirm3) || !confirm3) {
+      p2.outro("No changes made.");
       return;
     }
-    installMcpConfig(agent, apiKey, "project");
+    installMcpConfig(agent, apiKey, "project", ac);
     const configPath = getAgentConfigPath(agent, "project");
-    p.log.success(`${agent.name}: ${configPath} created`);
-    p.note(
-      pc2.yellow("Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key."),
+    p2.log.success(`${agent.name}: ${configPath} created`);
+    p2.note(
+      pc3.yellow("Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key."),
       "Tip"
     );
-    p.outro("Done.");
+    p2.outro("Done.");
     return;
   }
-  const selected = await p.multiselect({
+  const selected = await p2.multiselect({
     message: "Select agents for project-level MCP:",
     options: missing.map((s) => ({
       value: s.agent.id,
       label: s.agent.name
     }))
   });
-  if (p.isCancel(selected)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(selected)) {
+    p2.outro("No changes made.");
     return;
   }
   const agents = missing.filter((s) => selected.includes(s.agent.id));
   for (const s of agents) {
-    installMcpConfig(s.agent, apiKey, "project");
+    installMcpConfig(s.agent, apiKey, "project", ac);
     const configPath = getAgentConfigPath(s.agent, "project");
-    p.log.success(`${s.agent.name}: ${configPath} created`);
+    p2.log.success(`${s.agent.name}: ${configPath} created`);
   }
-  p.note(
-    pc2.yellow("Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key."),
+  p2.note(
+    pc3.yellow("Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key."),
     "Tip"
   );
-  p.outro("Done.");
+  p2.outro("Done.");
 }
 async function freshSetup(options) {
-  p.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, "API Key");
-  const openBrowser = await p.confirm({
+  p2.note(`Get your API key at:
+${pc3.cyan(getApiKeyUrl())}`, "API Key");
+  const openBrowser = await p2.confirm({
     message: "Open browser to get API key?",
     initialValue: true
   });
-  if (p.isCancel(openBrowser)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(openBrowser)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
   if (openBrowser) {
     await openApiKeyPage();
   }
-  const apiKey = await p.text({
+  const apiKey = await p2.text({
     message: "Enter your Pica API key:",
     placeholder: "sk_live_...",
     validate: (value) => {
@@ -606,27 +836,27 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       return void 0;
     }
   });
-  if (p.isCancel(apiKey)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(apiKey)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
-  const spinner4 = p.spinner();
-  spinner4.start("Validating API key...");
+  const spinner5 = p2.spinner();
+  spinner5.start("Validating API key...");
   const api = new PicaApi(apiKey);
   const isValid = await api.validateApiKey();
   if (!isValid) {
-    spinner4.stop("Invalid API key");
-    p.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+    spinner5.stop("Invalid API key");
+    p2.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
     process.exit(1);
   }
-  spinner4.stop("API key validated");
+  spinner5.stop("API key validated");
   writeConfig({
     apiKey,
     installedAgents: [],
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   const allAgents = getAllAgents();
-  const agentChoice = await p.select({
+  const agentChoice = await p2.select({
     message: "Where do you want to install the MCP?",
     options: [
       {
@@ -640,8 +870,8 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       }))
     ]
   });
-  if (p.isCancel(agentChoice)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(agentChoice)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
   const selectedAgents = agentChoice === "all" ? allAgents : allAgents.filter((a) => a.id === agentChoice);
@@ -652,7 +882,7 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
   } else if (options.project) {
     scope = "project";
   } else if (hasProjectScopeAgent) {
-    const scopeChoice = await p.select({
+    const scopeChoice = await p2.select({
       message: "How do you want to install it?",
       options: [
         {
@@ -667,8 +897,8 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
         }
       ]
     });
-    if (p.isCancel(scopeChoice)) {
-      p.cancel("Setup cancelled.");
+    if (p2.isCancel(scopeChoice)) {
+      p2.cancel("Setup cancelled.");
       process.exit(0);
     }
     scope = scopeChoice;
@@ -678,12 +908,12 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
     const nonProjectAgents = selectedAgents.filter((a) => !supportsProjectScope(a));
     if (projectAgents.length === 0) {
       const supported = allAgents.filter((a) => supportsProjectScope(a)).map((a) => a.name).join(", ");
-      p.note(
+      p2.note(
         `${selectedAgents.map((a) => a.name).join(", ")} does not support project-level MCP.
 Project scope is supported by: ${supported}`,
         "Not Supported"
       );
-      p.cancel("Run again and choose global scope or a different agent.");
+      p2.cancel("Run again and choose global scope or a different agent.");
       process.exit(1);
     }
     for (const agent of projectAgents) {
@@ -691,15 +921,15 @@ Project scope is supported by: ${supported}`,
       installMcpConfig(agent, apiKey, "project");
       const configPath = getAgentConfigPath(agent, "project");
       const status = wasInstalled ? "updated" : "created";
-      p.log.success(`${agent.name}: ${configPath} ${status}`);
+      p2.log.success(`${agent.name}: ${configPath} ${status}`);
     }
     if (nonProjectAgents.length > 0) {
-      p.log.info(`Installing globally for agents without project scope support:`);
+      p2.log.info(`Installing globally for agents without project scope support:`);
       for (const agent of nonProjectAgents) {
         const wasInstalled = isMcpInstalled(agent, "global");
         installMcpConfig(agent, apiKey, "global");
         const status = wasInstalled ? "updated" : "installed";
-        p.log.success(`${agent.name}: MCP ${status} (global)`);
+        p2.log.success(`${agent.name}: MCP ${status} (global)`);
       }
     }
     const allInstalled = [...projectAgents, ...nonProjectAgents];
@@ -708,23 +938,23 @@ Project scope is supported by: ${supported}`,
       installedAgents: allInstalled.map((a) => a.id),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    const configPaths = projectAgents.map((a) => `  ${a.name}: ${pc2.dim(getAgentConfigPath(a, "project"))}`).join("\n");
-    let summary = `Config saved to: ${pc2.dim(getConfigPath())}
+    const configPaths = projectAgents.map((a) => `  ${a.name}: ${pc3.dim(getAgentConfigPath(a, "project"))}`).join("\n");
+    let summary = `Config saved to: ${pc3.dim(getConfigPath())}
 MCP configs:
 ${configPaths}
 
 `;
     if (nonProjectAgents.length > 0) {
-      const globalPaths = nonProjectAgents.map((a) => `  ${a.name}: ${pc2.dim(getAgentConfigPath(a, "global"))}`).join("\n");
+      const globalPaths = nonProjectAgents.map((a) => `  ${a.name}: ${pc3.dim(getAgentConfigPath(a, "global"))}`).join("\n");
       summary += `Global configs:
 ${globalPaths}
 
 `;
     }
-    summary += pc2.yellow("Note: Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key.");
-    p.note(summary, "Setup Complete");
+    summary += pc3.yellow("Note: Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key.");
+    p2.note(summary, "Setup Complete");
     await promptConnectIntegrations(apiKey);
-    p.outro("Your AI agents now have access to Pica integrations!");
+    p2.outro("Your AI agents now have access to Pica integrations!");
     return;
   }
   const installedAgentIds = [];
@@ -733,34 +963,34 @@ ${globalPaths}
     installMcpConfig(agent, apiKey, "global");
     installedAgentIds.push(agent.id);
     const status = wasInstalled ? "updated" : "installed";
-    p.log.success(`${agent.name}: MCP ${status}`);
+    p2.log.success(`${agent.name}: MCP ${status}`);
   }
   writeConfig({
     apiKey,
     installedAgents: installedAgentIds,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
-  p.note(
-    `Config saved to: ${pc2.dim(getConfigPath())}`,
+  p2.note(
+    `Config saved to: ${pc3.dim(getConfigPath())}`,
     "Setup Complete"
   );
   await promptConnectIntegrations(apiKey);
-  p.outro("Your AI agents now have access to Pica integrations!");
+  p2.outro("Your AI agents now have access to Pica integrations!");
 }
 function printBanner() {
   console.log();
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
   console.log();
-  console.log(pc2.dim("  U N I V E R S A L   I N T E G R A T I O N S   F O R   A I"));
+  console.log(pc3.dim("  U N I V E R S A L   I N T E G R A T I O N S   F O R   A I"));
   console.log();
 }
 var TOP_INTEGRATIONS = [
@@ -794,48 +1024,48 @@ async function promptConnectIntegrations(apiKey) {
       { value: "skip", label: "Skip for now", hint: "you can always run pica add later" }
     ];
     const message = first ? "Connect your first integration?" : "Connect another?";
-    const choice = await p.select({ message, options });
-    if (p.isCancel(choice) || choice === "skip") {
+    const choice = await p2.select({ message, options });
+    if (p2.isCancel(choice) || choice === "skip") {
       break;
     }
     if (choice === "more") {
       try {
         await open2("https://app.picaos.com/connections");
-        p.log.info("Opened Pica dashboard in browser.");
+        p2.log.info("Opened Pica dashboard in browser.");
       } catch {
-        p.note("https://app.picaos.com/connections", "Open in browser");
+        p2.note("https://app.picaos.com/connections", "Open in browser");
       }
-      p.log.info(`Connect from the dashboard, or use ${pc2.cyan("pica add <platform>")}`);
+      p2.log.info(`Connect from the dashboard, or use ${pc3.cyan("pica add <platform>")}`);
       break;
     }
     const platform = choice;
     const integration = TOP_INTEGRATIONS.find((i) => i.value === platform);
     const label = integration?.label ?? platform;
-    p.log.info(`Opening browser to connect ${pc2.cyan(label)}...`);
+    p2.log.info(`Opening browser to connect ${pc3.cyan(label)}...`);
     try {
       await openConnectionPage(platform);
     } catch {
       const url = getConnectionUrl(platform);
-      p.log.warn("Could not open browser automatically.");
-      p.note(url, "Open manually");
+      p2.log.warn("Could not open browser automatically.");
+      p2.note(url, "Open manually");
     }
-    const spinner4 = p.spinner();
-    spinner4.start("Waiting for connection... (complete auth in browser)");
+    const spinner5 = p2.spinner();
+    spinner5.start("Waiting for connection... (complete auth in browser)");
     try {
       await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
-      spinner4.stop(`${label} connected!`);
-      p.log.success(`${pc2.green("\u2713")} ${label} is now available to your AI agents`);
+      spinner5.stop(`${label} connected!`);
+      p2.log.success(`${pc3.green("\u2713")} ${label} is now available to your AI agents`);
       connected.push(platform);
       first = false;
     } catch (error) {
-      spinner4.stop("Connection timed out");
+      spinner5.stop("Connection timed out");
       if (error instanceof TimeoutError) {
-        p.log.warn(`No worries. Connect later with: ${pc2.cyan(`pica add ${platform}`)}`);
+        p2.log.warn(`No worries. Connect later with: ${pc3.cyan(`pica add ${platform}`)}`);
       }
       first = false;
     }
     if (TOP_INTEGRATIONS.every((i) => connected.includes(i.value))) {
-      p.log.success("All top integrations connected!");
+      p2.log.success("All top integrations connected!");
       break;
     }
   }
@@ -854,23 +1084,23 @@ function updateConfigAgents(agentId) {
 }
 
 // src/commands/connection.ts
-import * as p2 from "@clack/prompts";
-import pc3 from "picocolors";
+import * as p3 from "@clack/prompts";
+import pc4 from "picocolors";
 
 // src/lib/platforms.ts
 function findPlatform(platforms, query) {
   const normalizedQuery = query.toLowerCase().trim();
   const exact = platforms.find(
-    (p4) => p4.platform.toLowerCase() === normalizedQuery || p4.name.toLowerCase() === normalizedQuery
+    (p5) => p5.platform.toLowerCase() === normalizedQuery || p5.name.toLowerCase() === normalizedQuery
   );
   if (exact) return exact;
   return null;
 }
 function findSimilarPlatforms(platforms, query, limit = 3) {
   const normalizedQuery = query.toLowerCase().trim();
-  const scored = platforms.map((p4) => {
-    const name = p4.name.toLowerCase();
-    const slug = p4.platform.toLowerCase();
+  const scored = platforms.map((p5) => {
+    const name = p5.name.toLowerCase();
+    const slug = p5.platform.toLowerCase();
     let score = 0;
     if (name.includes(normalizedQuery) || slug.includes(normalizedQuery)) {
       score = 10;
@@ -879,7 +1109,7 @@ function findSimilarPlatforms(platforms, query, limit = 3) {
     } else {
       score = countMatchingChars(normalizedQuery, slug);
     }
-    return { platform: p4, score };
+    return { platform: p5, score };
   }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score).slice(0, limit);
   return scored.map((item) => item.platform);
 }
@@ -894,22 +1124,22 @@ function countMatchingChars(a, b) {
 
 // src/commands/connection.ts
 async function connectionAddCommand(platformArg) {
-  p2.intro(pc3.bgCyan(pc3.black(" Pica ")));
+  p3.intro(pc4.bgCyan(pc4.black(" Pica ")));
   const apiKey = getApiKey();
   if (!apiKey) {
-    p2.cancel("Not configured. Run `pica init` first.");
+    p3.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p2.spinner();
-  spinner4.start("Loading platforms...");
+  const spinner5 = p3.spinner();
+  spinner5.start("Loading platforms...");
   let platforms;
   try {
     platforms = await api.listPlatforms();
-    spinner4.stop(`${platforms.length} platforms available`);
+    spinner5.stop(`${platforms.length} platforms available`);
   } catch (error) {
-    spinner4.stop("Failed to load platforms");
-    p2.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner5.stop("Failed to load platforms");
+    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
   let platform;
@@ -920,29 +1150,29 @@ async function connectionAddCommand(platformArg) {
     } else {
       const similar = findSimilarPlatforms(platforms, platformArg);
       if (similar.length > 0) {
-        p2.log.warn(`Unknown platform: ${platformArg}`);
-        const suggestion = await p2.select({
+        p3.log.warn(`Unknown platform: ${platformArg}`);
+        const suggestion = await p3.select({
           message: "Did you mean:",
           options: [
             ...similar.map((s) => ({ value: s.platform, label: `${s.name} (${s.platform})` })),
             { value: "__other__", label: "None of these" }
           ]
         });
-        if (p2.isCancel(suggestion) || suggestion === "__other__") {
-          p2.note(`Run ${pc3.cyan("pica platforms")} to see all available platforms.`);
-          p2.cancel("Connection cancelled.");
+        if (p3.isCancel(suggestion) || suggestion === "__other__") {
+          p3.note(`Run ${pc4.cyan("pica platforms")} to see all available platforms.`);
+          p3.cancel("Connection cancelled.");
           process.exit(0);
         }
         platform = suggestion;
       } else {
-        p2.cancel(`Unknown platform: ${platformArg}
+        p3.cancel(`Unknown platform: ${platformArg}
 
-Run ${pc3.cyan("pica platforms")} to see available platforms.`);
+Run ${pc4.cyan("pica platforms")} to see available platforms.`);
         process.exit(1);
       }
     }
   } else {
-    const platformInput = await p2.text({
+    const platformInput = await p3.text({
       message: "Which platform do you want to connect?",
       placeholder: "gmail, slack, hubspot...",
       validate: (value) => {
@@ -950,51 +1180,51 @@ Run ${pc3.cyan("pica platforms")} to see available platforms.`);
         return void 0;
       }
     });
-    if (p2.isCancel(platformInput)) {
-      p2.cancel("Connection cancelled.");
+    if (p3.isCancel(platformInput)) {
+      p3.cancel("Connection cancelled.");
       process.exit(0);
     }
     const found = findPlatform(platforms, platformInput);
     if (found) {
       platform = found.platform;
     } else {
-      p2.cancel(`Unknown platform: ${platformInput}
+      p3.cancel(`Unknown platform: ${platformInput}
 
-Run ${pc3.cyan("pica platforms")} to see available platforms.`);
+Run ${pc4.cyan("pica platforms")} to see available platforms.`);
       process.exit(1);
     }
   }
   const url = getConnectionUrl(platform);
-  p2.log.info(`Opening browser to connect ${pc3.cyan(platform)}...`);
-  p2.note(pc3.dim(url), "URL");
+  p3.log.info(`Opening browser to connect ${pc4.cyan(platform)}...`);
+  p3.note(pc4.dim(url), "URL");
   try {
     await openConnectionPage(platform);
   } catch {
-    p2.log.warn("Could not open browser automatically.");
-    p2.note(`Open this URL manually:
+    p3.log.warn("Could not open browser automatically.");
+    p3.note(`Open this URL manually:
 ${url}`);
   }
-  const pollSpinner = p2.spinner();
+  const pollSpinner = p3.spinner();
   pollSpinner.start("Waiting for connection... (complete auth in browser)");
   try {
     const connection2 = await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
     pollSpinner.stop(`${platform} connected!`);
-    p2.log.success(`${pc3.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
-    p2.outro("Connection complete!");
+    p3.log.success(`${pc4.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
+    p3.outro("Connection complete!");
   } catch (error) {
     pollSpinner.stop("Connection timed out");
     if (error instanceof TimeoutError) {
-      p2.note(
+      p3.note(
         `Possible issues:
   - OAuth flow was not completed in the browser
   - Browser popup was blocked
   - Wrong account selected
 
-Try again with: ${pc3.cyan(`pica connection add ${platform}`)}`,
+Try again with: ${pc4.cyan(`pica connection add ${platform}`)}`,
         "Timed Out"
       );
     } else {
-      p2.log.error(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+      p3.log.error(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     }
     process.exit(1);
   }
@@ -1002,20 +1232,20 @@ Try again with: ${pc3.cyan(`pica connection add ${platform}`)}`,
 async function connectionListCommand() {
   const apiKey = getApiKey();
   if (!apiKey) {
-    p2.cancel("Not configured. Run `pica init` first.");
+    p3.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p2.spinner();
-  spinner4.start("Loading connections...");
+  const spinner5 = p3.spinner();
+  spinner5.start("Loading connections...");
   try {
     const connections = await api.listConnections();
-    spinner4.stop(`${connections.length} connection${connections.length === 1 ? "" : "s"} found`);
+    spinner5.stop(`${connections.length} connection${connections.length === 1 ? "" : "s"} found`);
     if (connections.length === 0) {
-      p2.note(
+      p3.note(
         `No connections yet.
 
-Add one with: ${pc3.cyan("pica connection add gmail")}`,
+Add one with: ${pc4.cyan("pica connection add gmail")}`,
         "No Connections"
       );
       return;
@@ -1032,46 +1262,46 @@ Add one with: ${pc3.cyan("pica connection add gmail")}`,
         { key: "status", label: "" },
         { key: "platform", label: "Platform" },
         { key: "state", label: "Status" },
-        { key: "key", label: "Connection Key", color: pc3.dim }
+        { key: "key", label: "Connection Key", color: pc4.dim }
       ],
       rows
     );
     console.log();
-    p2.note(`Add more with: ${pc3.cyan("pica connection add <platform>")}`, "Tip");
+    p3.note(`Add more with: ${pc4.cyan("pica connection add <platform>")}`, "Tip");
   } catch (error) {
-    spinner4.stop("Failed to load connections");
-    p2.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner5.stop("Failed to load connections");
+    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
 }
 function getStatusIndicator(state) {
   switch (state) {
     case "operational":
-      return pc3.green("\u25CF");
+      return pc4.green("\u25CF");
     case "degraded":
-      return pc3.yellow("\u25CF");
+      return pc4.yellow("\u25CF");
     case "failed":
-      return pc3.red("\u25CF");
+      return pc4.red("\u25CF");
     default:
-      return pc3.dim("\u25CB");
+      return pc4.dim("\u25CB");
   }
 }
 
 // src/commands/platforms.ts
-import * as p3 from "@clack/prompts";
-import pc4 from "picocolors";
+import * as p4 from "@clack/prompts";
+import pc5 from "picocolors";
 async function platformsCommand(options) {
   const apiKey = getApiKey();
   if (!apiKey) {
-    p3.cancel("Not configured. Run `pica init` first.");
+    p4.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p3.spinner();
-  spinner4.start("Loading platforms...");
+  const spinner5 = p4.spinner();
+  spinner5.start("Loading platforms...");
   try {
     const platforms = await api.listPlatforms();
-    spinner4.stop(`${platforms.length} platforms available`);
+    spinner5.stop(`${platforms.length} platforms available`);
     if (options.json) {
       console.log(JSON.stringify(platforms, null, 2));
       return;
@@ -1089,7 +1319,7 @@ async function platformsCommand(options) {
       const categoryPlatforms = byCategory.get(options.category);
       if (!categoryPlatforms) {
         const categories = [...byCategory.keys()].sort();
-        p3.note(`Available categories:
+        p4.note(`Available categories:
   ${categories.join(", ")}`, "Unknown Category");
         process.exit(1);
       }
@@ -1121,10 +1351,10 @@ async function platformsCommand(options) {
       );
     }
     console.log();
-    p3.note(`Connect with: ${pc4.cyan("pica connection add <platform>")}`, "Tip");
+    p4.note(`Connect with: ${pc5.cyan("pica connection add <platform>")}`, "Tip");
   } catch (error) {
-    spinner4.stop("Failed to load platforms");
-    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner5.stop("Failed to load platforms");
+    p4.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
 }
@@ -1137,6 +1367,9 @@ program.name("pica").description("CLI for managing Pica").version(version);
 program.command("init").description("Set up Pica and install MCP to your AI agents").option("-y, --yes", "Skip confirmations").option("-g, --global", "Install MCP globally (available in all projects)").option("-p, --project", "Install MCP for this project only (creates .mcp.json)").action(async (options) => {
   await initCommand(options);
 });
+program.command("config").description("Configure MCP access control (permissions, connections, actions)").action(async () => {
+  await configCommand();
+});
 var connection = program.command("connection").description("Manage connections");
 connection.command("add [platform]").alias("a").description("Add a new connection").action(async (platform) => {
   await connectionAddCommand(platform);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@picahq/cli",
-  "version": "1.6.0",
+  "version": "1.8.0",
   "description": "CLI for managing Pica",
   "type": "module",
   "files": [