@picahq/cli 1.7.0 → 1.8.0

package/dist/index.js

@@ -5,8 +5,8 @@ import { createRequire } from "module";
 import { Command } from "commander";
 
 // src/commands/init.ts
-import * as p from "@clack/prompts";
-import pc2 from "picocolors";
+import * as p2 from "@clack/prompts";
+import pc3 from "picocolors";
 
 // src/lib/config.ts
 import fs from "fs";
@@ -41,17 +41,43 @@ function getApiKey() {
   const config = readConfig();
   return config?.apiKey ?? null;
 }
+function getAccessControl() {
+  return readConfig()?.accessControl ?? {};
+}
+function updateAccessControl(settings) {
+  const config = readConfig();
+  if (!config) return;
+  const cleaned = {};
+  if (settings.permissions && settings.permissions !== "admin") {
+    cleaned.permissions = settings.permissions;
+  }
+  if (settings.connectionKeys && !(settings.connectionKeys.length === 1 && settings.connectionKeys[0] === "*")) {
+    cleaned.connectionKeys = settings.connectionKeys;
+  }
+  if (settings.actionIds && !(settings.actionIds.length === 1 && settings.actionIds[0] === "*")) {
+    cleaned.actionIds = settings.actionIds;
+  }
+  if (settings.knowledgeAgent) {
+    cleaned.knowledgeAgent = true;
+  }
+  if (Object.keys(cleaned).length === 0) {
+    delete config.accessControl;
+  } else {
+    config.accessControl = cleaned;
+  }
+  writeConfig(config);
+}
 
 // src/lib/agents.ts
 import fs2 from "fs";
 import path2 from "path";
 import os2 from "os";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-function expandPath(p4) {
-  if (p4.startsWith("~/")) {
-    return path2.join(os2.homedir(), p4.slice(2));
+function expandPath(p5) {
+  if (p5.startsWith("~/")) {
+    return path2.join(os2.homedir(), p5.slice(2));
   }
-  return p4;
+  return p5;
 }
 function getClaudeDesktopConfigPath() {
   switch (process.platform) {
@@ -179,20 +205,35 @@ function writeAgentConfig(agent, config, scope = "global") {
     fs2.writeFileSync(configPath, JSON.stringify(config, null, 2));
   }
 }
-function getMcpServerConfig(apiKey) {
+function getMcpServerConfig(apiKey, accessControl) {
+  const env = {
+    PICA_SECRET: apiKey
+  };
+  if (accessControl) {
+    if (accessControl.permissions && accessControl.permissions !== "admin") {
+      env.PICA_PERMISSIONS = accessControl.permissions;
+    }
+    if (accessControl.connectionKeys && !(accessControl.connectionKeys.length === 1 && accessControl.connectionKeys[0] === "*")) {
+      env.PICA_CONNECTION_KEYS = accessControl.connectionKeys.join(",");
+    }
+    if (accessControl.actionIds && !(accessControl.actionIds.length === 1 && accessControl.actionIds[0] === "*")) {
+      env.PICA_ACTION_IDS = accessControl.actionIds.join(",");
+    }
+    if (accessControl.knowledgeAgent) {
+      env.PICA_KNOWLEDGE_AGENT = "true";
+    }
+  }
   return {
     command: "npx",
     args: ["-y", "@picahq/mcp"],
-    env: {
-      PICA_SECRET: apiKey
-    }
+    env
   };
 }
-function installMcpConfig(agent, apiKey, scope = "global") {
+function installMcpConfig(agent, apiKey, scope = "global", accessControl) {
   const config = readAgentConfig(agent, scope);
   const configKey = agent.configKey;
   const mcpServers = config[configKey] || {};
-  mcpServers["pica"] = getMcpServerConfig(apiKey);
+  mcpServers["pica"] = getMcpServerConfig(apiKey, accessControl);
   config[configKey] = mcpServers;
   writeAgentConfig(agent, config, scope);
 }
@@ -247,8 +288,8 @@ var PicaApi = class {
     }
     const response = await fetch(url, fetchOpts);
     if (!response.ok) {
-      const text3 = await response.text();
-      throw new ApiError(response.status, text3 || `HTTP ${response.status}`);
+      const text4 = await response.text();
+      throw new ApiError(response.status, text4 || `HTTP ${response.status}`);
     }
     return response.json();
   }
@@ -324,11 +365,171 @@ async function openApiKeyPage() {
   await open(getApiKeyUrl());
 }
 
+// src/commands/config.ts
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+async function configCommand() {
+  const config = readConfig();
+  if (!config) {
+    p.log.error(`No Pica config found. Run ${pc.cyan("pica init")} first.`);
+    return;
+  }
+  p.intro(pc.bgCyan(pc.black(" Pica Access Control ")));
+  const current = getAccessControl();
+  console.log();
+  console.log(`  ${pc.bold("Current Access Control")}`);
+  console.log(`  ${pc.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc.dim("Permissions:")}   ${current.permissions ?? "admin"}`);
+  console.log(`  ${pc.dim("Connections:")}   ${formatList(current.connectionKeys)}`);
+  console.log(`  ${pc.dim("Action IDs:")}    ${formatList(current.actionIds)}`);
+  console.log(`  ${pc.dim("Knowledge only:")} ${current.knowledgeAgent ? "yes" : "no"}`);
+  console.log();
+  const permissions = await p.select({
+    message: "Permission level",
+    options: [
+      { value: "admin", label: "Admin", hint: "Full access (GET, POST, PUT, PATCH, DELETE)" },
+      { value: "write", label: "Write", hint: "GET, POST, PUT, PATCH" },
+      { value: "read", label: "Read", hint: "GET only" }
+    ],
+    initialValue: current.permissions ?? "admin"
+  });
+  if (p.isCancel(permissions)) {
+    p.outro("No changes made.");
+    return;
+  }
+  const connectionMode = await p.select({
+    message: "Connection scope",
+    options: [
+      { value: "all", label: "All connections" },
+      { value: "specific", label: "Select specific connections" }
+    ],
+    initialValue: current.connectionKeys ? "specific" : "all"
+  });
+  if (p.isCancel(connectionMode)) {
+    p.outro("No changes made.");
+    return;
+  }
+  let connectionKeys;
+  if (connectionMode === "specific") {
+    connectionKeys = await selectConnections(config.apiKey);
+    if (connectionKeys === void 0) {
+      p.outro("No changes made.");
+      return;
+    }
+    if (connectionKeys.length === 0) {
+      p.log.info(`No connections found. Defaulting to all. Use ${pc.cyan("pica add")} to connect platforms.`);
+      connectionKeys = void 0;
+    }
+  }
+  const actionMode = await p.select({
+    message: "Action scope",
+    options: [
+      { value: "all", label: "All actions" },
+      { value: "specific", label: "Restrict to specific action IDs" }
+    ],
+    initialValue: current.actionIds ? "specific" : "all"
+  });
+  if (p.isCancel(actionMode)) {
+    p.outro("No changes made.");
+    return;
+  }
+  let actionIds;
+  if (actionMode === "specific") {
+    const actionInput = await p.text({
+      message: "Enter action IDs (comma-separated):",
+      placeholder: "action-id-1, action-id-2",
+      initialValue: current.actionIds?.join(", ") ?? "",
+      validate: (value) => {
+        if (!value.trim()) return "At least one action ID is required";
+        return void 0;
+      }
+    });
+    if (p.isCancel(actionInput)) {
+      p.outro("No changes made.");
+      return;
+    }
+    actionIds = actionInput.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  const knowledgeAgent = await p.confirm({
+    message: "Enable knowledge-only mode? (disables action execution)",
+    initialValue: current.knowledgeAgent ?? false
+  });
+  if (p.isCancel(knowledgeAgent)) {
+    p.outro("No changes made.");
+    return;
+  }
+  const settings = {
+    permissions,
+    connectionKeys: connectionKeys ?? ["*"],
+    actionIds: actionIds ?? ["*"],
+    knowledgeAgent
+  };
+  updateAccessControl(settings);
+  const ac = getAccessControl();
+  const statuses = getAgentStatuses();
+  const reinstalled = [];
+  for (const s of statuses) {
+    if (s.globalMcp) {
+      installMcpConfig(s.agent, config.apiKey, "global", ac);
+      reinstalled.push(`${s.agent.name} (global)`);
+    }
+    if (s.projectMcp) {
+      installMcpConfig(s.agent, config.apiKey, "project", ac);
+      reinstalled.push(`${s.agent.name} (project)`);
+    }
+  }
+  if (reinstalled.length > 0) {
+    p.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
+  }
+  p.outro("Access control updated.");
+}
+async function selectConnections(apiKey) {
+  const spinner5 = p.spinner();
+  spinner5.start("Fetching connections...");
+  let connections;
+  try {
+    const api = new PicaApi(apiKey);
+    const rawConnections = await api.listConnections();
+    connections = rawConnections.map((c) => ({ platform: c.platform, key: c.key }));
+    spinner5.stop(`Found ${connections.length} connection(s)`);
+  } catch {
+    spinner5.stop("Could not fetch connections");
+    const manual = await p.text({
+      message: "Enter connection keys manually (comma-separated):",
+      placeholder: "conn_key_1, conn_key_2",
+      validate: (value) => {
+        if (!value.trim()) return "At least one connection key is required";
+        return void 0;
+      }
+    });
+    if (p.isCancel(manual)) return void 0;
+    return manual.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  if (connections.length === 0) {
+    return [];
+  }
+  const selected = await p.multiselect({
+    message: "Select connections:",
+    options: connections.map((c) => ({
+      value: c.key,
+      label: `${c.platform}`,
+      hint: c.key
+    }))
+  });
+  if (p.isCancel(selected)) return void 0;
+  return selected;
+}
+function formatList(list) {
+  if (!list || list.length === 0) return "all";
+  if (list.length === 1 && list[0] === "*") return "all";
+  return list.join(", ");
+}
+
 // src/commands/init.ts
 import open2 from "open";
 
 // src/lib/table.ts
-import pc from "picocolors";
+import pc2 from "picocolors";
 function printTable(columns, rows) {
   if (rows.length === 0) return;
   const gap = "  ";
@@ -340,10 +541,10 @@ function printTable(columns, rows) {
   });
   const header = columns.map((col, i) => {
     const padded = col.align === "right" ? col.label.padStart(widths[i]) : col.label.padEnd(widths[i]);
-    return pc.dim(padded);
+    return pc2.dim(padded);
   }).join(gap);
   console.log(`${indent}${header}`);
-  const separator = columns.map((_, i) => pc.dim("\u2500".repeat(widths[i]))).join(gap);
+  const separator = columns.map((_, i) => pc2.dim("\u2500".repeat(widths[i]))).join(gap);
   console.log(`${indent}${separator}`);
   for (const row of rows) {
     const line = columns.map((col, i) => {
@@ -367,7 +568,7 @@ function stripAnsi(str) {
 async function initCommand(options) {
   const existingConfig = readConfig();
   if (existingConfig) {
-    p.intro(pc2.bgCyan(pc2.black(" Pica ")));
+    p2.intro(pc3.bgCyan(pc3.black(" Pica ")));
     await handleExistingConfig(existingConfig.apiKey, options);
     return;
   }
@@ -378,10 +579,10 @@ async function handleExistingConfig(apiKey, options) {
   const statuses = getAgentStatuses();
   const masked = maskApiKey(apiKey);
   console.log();
-  console.log(`  ${pc2.bold("Current Setup")}`);
-  console.log(`  ${pc2.dim("\u2500".repeat(42))}`);
-  console.log(`  ${pc2.dim("API Key:")}  ${masked}`);
-  console.log(`  ${pc2.dim("Config:")}   ${getConfigPath()}`);
+  console.log(`  ${pc3.bold("Current Setup")}`);
+  console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc3.dim("API Key:")}  ${masked}`);
+  console.log(`  ${pc3.dim("Config:")}   ${getConfigPath()}`);
   console.log();
   printTable(
     [
@@ -391,15 +592,24 @@ async function handleExistingConfig(apiKey, options) {
     ],
     statuses.map((s) => ({
       agent: s.agent.name,
-      global: !s.detected ? pc2.dim("-") : s.globalMcp ? pc2.green("\u25CF yes") : pc2.yellow("\u25CB no"),
-      project: s.projectMcp === null ? pc2.dim("-") : s.projectMcp ? pc2.green("\u25CF yes") : pc2.yellow("\u25CB no")
+      global: !s.detected ? pc3.dim("-") : s.globalMcp ? pc3.green("\u25CF yes") : pc3.yellow("\u25CB no"),
+      project: s.projectMcp === null ? pc3.dim("-") : s.projectMcp ? pc3.green("\u25CF yes") : pc3.yellow("\u25CB no")
     }))
   );
   const notDetected = statuses.filter((s) => !s.detected);
   if (notDetected.length > 0) {
-    console.log(`  ${pc2.dim("- = not detected on this machine")}`);
+    console.log(`  ${pc3.dim("- = not detected on this machine")}`);
+  }
+  const ac = getAccessControl();
+  if (Object.keys(ac).length > 0) {
+    console.log(`  ${pc3.bold("Access Control")}`);
+    console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
+    if (ac.permissions) console.log(`  ${pc3.dim("Permissions:")}   ${ac.permissions}`);
+    if (ac.connectionKeys) console.log(`  ${pc3.dim("Connections:")}   ${ac.connectionKeys.join(", ")}`);
+    if (ac.actionIds) console.log(`  ${pc3.dim("Action IDs:")}    ${ac.actionIds.join(", ")}`);
+    if (ac.knowledgeAgent) console.log(`  ${pc3.dim("Knowledge only:")} yes`);
+    console.log();
   }
-  console.log();
   const actionOptions = [];
   actionOptions.push({
     value: "update-key",
@@ -421,16 +631,21 @@ async function handleExistingConfig(apiKey, options) {
       hint: agentsMissingProject.map((s) => s.agent.name).join(", ")
     });
   }
+  actionOptions.push({
+    value: "access-control",
+    label: "Configure access control",
+    hint: "permissions, connections, actions"
+  });
   actionOptions.push({
     value: "start-fresh",
     label: "Start fresh (reconfigure everything)"
   });
-  const action = await p.select({
+  const action = await p2.select({
     message: "What would you like to do?",
     options: actionOptions
   });
-  if (p.isCancel(action)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(action)) {
+    p2.outro("No changes made.");
     return;
   }
   switch (action) {
@@ -443,26 +658,29 @@ async function handleExistingConfig(apiKey, options) {
     case "install-project":
       await handleInstallProject(apiKey, agentsMissingProject);
       break;
+    case "access-control":
+      await configCommand();
+      break;
     case "start-fresh":
       await freshSetup({ yes: true });
       break;
   }
 }
 async function handleUpdateKey(statuses) {
-  p.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, "API Key");
-  const openBrowser = await p.confirm({
+  p2.note(`Get your API key at:
+${pc3.cyan(getApiKeyUrl())}`, "API Key");
+  const openBrowser = await p2.confirm({
     message: "Open browser to get API key?",
     initialValue: true
   });
-  if (p.isCancel(openBrowser)) {
-    p.cancel("Cancelled.");
+  if (p2.isCancel(openBrowser)) {
+    p2.cancel("Cancelled.");
     process.exit(0);
   }
   if (openBrowser) {
     await openApiKeyPage();
   }
-  const newKey = await p.text({
+  const newKey = await p2.text({
     message: "Enter your new Pica API key:",
     placeholder: "sk_live_...",
     validate: (value) => {
@@ -473,28 +691,29 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       return void 0;
     }
   });
-  if (p.isCancel(newKey)) {
-    p.cancel("Cancelled.");
+  if (p2.isCancel(newKey)) {
+    p2.cancel("Cancelled.");
     process.exit(0);
   }
-  const spinner4 = p.spinner();
-  spinner4.start("Validating API key...");
+  const spinner5 = p2.spinner();
+  spinner5.start("Validating API key...");
   const api = new PicaApi(newKey);
   const isValid = await api.validateApiKey();
   if (!isValid) {
-    spinner4.stop("Invalid API key");
-    p.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+    spinner5.stop("Invalid API key");
+    p2.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
     process.exit(1);
   }
-  spinner4.stop("API key validated");
+  spinner5.stop("API key validated");
+  const ac = getAccessControl();
   const reinstalled = [];
   for (const s of statuses) {
     if (s.globalMcp) {
-      installMcpConfig(s.agent, newKey, "global");
+      installMcpConfig(s.agent, newKey, "global", ac);
       reinstalled.push(`${s.agent.name} (global)`);
     }
     if (s.projectMcp) {
-      installMcpConfig(s.agent, newKey, "project");
+      installMcpConfig(s.agent, newKey, "project", ac);
       reinstalled.push(`${s.agent.name} (project)`);
     }
   }
@@ -502,108 +721,111 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
   writeConfig({
     apiKey: newKey,
     installedAgents: config?.installedAgents ?? [],
-    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    accessControl: config?.accessControl
   });
   if (reinstalled.length > 0) {
-    p.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
+    p2.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
   }
-  p.outro("API key updated.");
+  p2.outro("API key updated.");
 }
 async function handleInstallMore(apiKey, missing) {
+  const ac = getAccessControl();
   if (missing.length === 1) {
     const agent = missing[0].agent;
-    const confirm2 = await p.confirm({
+    const confirm3 = await p2.confirm({
       message: `Install Pica MCP to ${agent.name}?`,
       initialValue: true
     });
-    if (p.isCancel(confirm2) || !confirm2) {
-      p.outro("No changes made.");
+    if (p2.isCancel(confirm3) || !confirm3) {
+      p2.outro("No changes made.");
       return;
     }
-    installMcpConfig(agent, apiKey, "global");
+    installMcpConfig(agent, apiKey, "global", ac);
     updateConfigAgents(agent.id);
-    p.log.success(`${agent.name}: MCP installed`);
-    p.outro("Done.");
+    p2.log.success(`${agent.name}: MCP installed`);
+    p2.outro("Done.");
     return;
   }
-  const selected = await p.multiselect({
+  const selected = await p2.multiselect({
     message: "Select agents to install MCP:",
     options: missing.map((s) => ({
       value: s.agent.id,
       label: s.agent.name
     }))
   });
-  if (p.isCancel(selected)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(selected)) {
+    p2.outro("No changes made.");
     return;
   }
   const agents = missing.filter((s) => selected.includes(s.agent.id));
   for (const s of agents) {
-    installMcpConfig(s.agent, apiKey, "global");
+    installMcpConfig(s.agent, apiKey, "global", ac);
     updateConfigAgents(s.agent.id);
-    p.log.success(`${s.agent.name}: MCP installed`);
+    p2.log.success(`${s.agent.name}: MCP installed`);
   }
-  p.outro("Done.");
+  p2.outro("Done.");
 }
 async function handleInstallProject(apiKey, missing) {
+  const ac = getAccessControl();
   if (missing.length === 1) {
     const agent = missing[0].agent;
-    const confirm2 = await p.confirm({
+    const confirm3 = await p2.confirm({
       message: `Install project-level MCP for ${agent.name}?`,
       initialValue: true
     });
-    if (p.isCancel(confirm2) || !confirm2) {
-      p.outro("No changes made.");
+    if (p2.isCancel(confirm3) || !confirm3) {
+      p2.outro("No changes made.");
       return;
     }
-    installMcpConfig(agent, apiKey, "project");
+    installMcpConfig(agent, apiKey, "project", ac);
     const configPath = getAgentConfigPath(agent, "project");
-    p.log.success(`${agent.name}: ${configPath} created`);
-    p.note(
-      pc2.yellow("Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key."),
+    p2.log.success(`${agent.name}: ${configPath} created`);
+    p2.note(
+      pc3.yellow("Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key."),
       "Tip"
     );
-    p.outro("Done.");
+    p2.outro("Done.");
     return;
   }
-  const selected = await p.multiselect({
+  const selected = await p2.multiselect({
     message: "Select agents for project-level MCP:",
     options: missing.map((s) => ({
       value: s.agent.id,
       label: s.agent.name
     }))
   });
-  if (p.isCancel(selected)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(selected)) {
+    p2.outro("No changes made.");
     return;
   }
   const agents = missing.filter((s) => selected.includes(s.agent.id));
   for (const s of agents) {
-    installMcpConfig(s.agent, apiKey, "project");
+    installMcpConfig(s.agent, apiKey, "project", ac);
     const configPath = getAgentConfigPath(s.agent, "project");
-    p.log.success(`${s.agent.name}: ${configPath} created`);
+    p2.log.success(`${s.agent.name}: ${configPath} created`);
   }
-  p.note(
-    pc2.yellow("Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key."),
+  p2.note(
+    pc3.yellow("Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key."),
     "Tip"
   );
-  p.outro("Done.");
+  p2.outro("Done.");
 }
 async function freshSetup(options) {
-  p.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, "API Key");
-  const openBrowser = await p.confirm({
+  p2.note(`Get your API key at:
+${pc3.cyan(getApiKeyUrl())}`, "API Key");
+  const openBrowser = await p2.confirm({
     message: "Open browser to get API key?",
     initialValue: true
   });
-  if (p.isCancel(openBrowser)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(openBrowser)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
   if (openBrowser) {
     await openApiKeyPage();
   }
-  const apiKey = await p.text({
+  const apiKey = await p2.text({
     message: "Enter your Pica API key:",
     placeholder: "sk_live_...",
     validate: (value) => {
@@ -614,27 +836,27 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       return void 0;
     }
   });
-  if (p.isCancel(apiKey)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(apiKey)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
-  const spinner4 = p.spinner();
-  spinner4.start("Validating API key...");
+  const spinner5 = p2.spinner();
+  spinner5.start("Validating API key...");
   const api = new PicaApi(apiKey);
   const isValid = await api.validateApiKey();
   if (!isValid) {
-    spinner4.stop("Invalid API key");
-    p.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+    spinner5.stop("Invalid API key");
+    p2.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
     process.exit(1);
   }
-  spinner4.stop("API key validated");
+  spinner5.stop("API key validated");
   writeConfig({
     apiKey,
     installedAgents: [],
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   const allAgents = getAllAgents();
-  const agentChoice = await p.select({
+  const agentChoice = await p2.select({
     message: "Where do you want to install the MCP?",
     options: [
       {
@@ -648,8 +870,8 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       }))
     ]
   });
-  if (p.isCancel(agentChoice)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(agentChoice)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
   const selectedAgents = agentChoice === "all" ? allAgents : allAgents.filter((a) => a.id === agentChoice);
@@ -660,7 +882,7 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
   } else if (options.project) {
     scope = "project";
   } else if (hasProjectScopeAgent) {
-    const scopeChoice = await p.select({
+    const scopeChoice = await p2.select({
       message: "How do you want to install it?",
       options: [
         {
@@ -675,8 +897,8 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
         }
       ]
     });
-    if (p.isCancel(scopeChoice)) {
-      p.cancel("Setup cancelled.");
+    if (p2.isCancel(scopeChoice)) {
+      p2.cancel("Setup cancelled.");
       process.exit(0);
     }
     scope = scopeChoice;
@@ -686,12 +908,12 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
     const nonProjectAgents = selectedAgents.filter((a) => !supportsProjectScope(a));
     if (projectAgents.length === 0) {
       const supported = allAgents.filter((a) => supportsProjectScope(a)).map((a) => a.name).join(", ");
-      p.note(
+      p2.note(
         `${selectedAgents.map((a) => a.name).join(", ")} does not support project-level MCP.
 Project scope is supported by: ${supported}`,
         "Not Supported"
       );
-      p.cancel("Run again and choose global scope or a different agent.");
+      p2.cancel("Run again and choose global scope or a different agent.");
       process.exit(1);
     }
     for (const agent of projectAgents) {
@@ -699,15 +921,15 @@ Project scope is supported by: ${supported}`,
       installMcpConfig(agent, apiKey, "project");
       const configPath = getAgentConfigPath(agent, "project");
       const status = wasInstalled ? "updated" : "created";
-      p.log.success(`${agent.name}: ${configPath} ${status}`);
+      p2.log.success(`${agent.name}: ${configPath} ${status}`);
     }
     if (nonProjectAgents.length > 0) {
-      p.log.info(`Installing globally for agents without project scope support:`);
+      p2.log.info(`Installing globally for agents without project scope support:`);
       for (const agent of nonProjectAgents) {
         const wasInstalled = isMcpInstalled(agent, "global");
         installMcpConfig(agent, apiKey, "global");
         const status = wasInstalled ? "updated" : "installed";
-        p.log.success(`${agent.name}: MCP ${status} (global)`);
+        p2.log.success(`${agent.name}: MCP ${status} (global)`);
       }
     }
     const allInstalled = [...projectAgents, ...nonProjectAgents];
@@ -716,23 +938,23 @@ Project scope is supported by: ${supported}`,
       installedAgents: allInstalled.map((a) => a.id),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    const configPaths = projectAgents.map((a) => `  ${a.name}: ${pc2.dim(getAgentConfigPath(a, "project"))}`).join("\n");
-    let summary = `Config saved to: ${pc2.dim(getConfigPath())}
+    const configPaths = projectAgents.map((a) => `  ${a.name}: ${pc3.dim(getAgentConfigPath(a, "project"))}`).join("\n");
+    let summary = `Config saved to: ${pc3.dim(getConfigPath())}
 MCP configs:
 ${configPaths}
 
 `;
     if (nonProjectAgents.length > 0) {
-      const globalPaths = nonProjectAgents.map((a) => `  ${a.name}: ${pc2.dim(getAgentConfigPath(a, "global"))}`).join("\n");
+      const globalPaths = nonProjectAgents.map((a) => `  ${a.name}: ${pc3.dim(getAgentConfigPath(a, "global"))}`).join("\n");
       summary += `Global configs:
 ${globalPaths}
 
 `;
     }
-    summary += pc2.yellow("Note: Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key.");
-    p.note(summary, "Setup Complete");
+    summary += pc3.yellow("Note: Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key.");
+    p2.note(summary, "Setup Complete");
     await promptConnectIntegrations(apiKey);
-    p.outro("Your AI agents now have access to Pica integrations!");
+    p2.outro("Your AI agents now have access to Pica integrations!");
     return;
   }
   const installedAgentIds = [];
@@ -741,34 +963,34 @@ ${globalPaths}
     installMcpConfig(agent, apiKey, "global");
     installedAgentIds.push(agent.id);
     const status = wasInstalled ? "updated" : "installed";
-    p.log.success(`${agent.name}: MCP ${status}`);
+    p2.log.success(`${agent.name}: MCP ${status}`);
   }
   writeConfig({
     apiKey,
     installedAgents: installedAgentIds,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
-  p.note(
-    `Config saved to: ${pc2.dim(getConfigPath())}`,
+  p2.note(
+    `Config saved to: ${pc3.dim(getConfigPath())}`,
     "Setup Complete"
   );
   await promptConnectIntegrations(apiKey);
-  p.outro("Your AI agents now have access to Pica integrations!");
+  p2.outro("Your AI agents now have access to Pica integrations!");
 }
 function printBanner() {
   console.log();
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
   console.log();
-  console.log(pc2.dim("  U N I V E R S A L   I N T E G R A T I O N S   F O R   A I"));
+  console.log(pc3.dim("  U N I V E R S A L   I N T E G R A T I O N S   F O R   A I"));
   console.log();
 }
 var TOP_INTEGRATIONS = [
@@ -802,48 +1024,48 @@ async function promptConnectIntegrations(apiKey) {
       { value: "skip", label: "Skip for now", hint: "you can always run pica add later" }
     ];
     const message = first ? "Connect your first integration?" : "Connect another?";
-    const choice = await p.select({ message, options });
-    if (p.isCancel(choice) || choice === "skip") {
+    const choice = await p2.select({ message, options });
+    if (p2.isCancel(choice) || choice === "skip") {
       break;
     }
     if (choice === "more") {
       try {
         await open2("https://app.picaos.com/connections");
-        p.log.info("Opened Pica dashboard in browser.");
+        p2.log.info("Opened Pica dashboard in browser.");
       } catch {
-        p.note("https://app.picaos.com/connections", "Open in browser");
+        p2.note("https://app.picaos.com/connections", "Open in browser");
       }
-      p.log.info(`Connect from the dashboard, or use ${pc2.cyan("pica add <platform>")}`);
+      p2.log.info(`Connect from the dashboard, or use ${pc3.cyan("pica add <platform>")}`);
       break;
     }
     const platform = choice;
     const integration = TOP_INTEGRATIONS.find((i) => i.value === platform);
     const label = integration?.label ?? platform;
-    p.log.info(`Opening browser to connect ${pc2.cyan(label)}...`);
+    p2.log.info(`Opening browser to connect ${pc3.cyan(label)}...`);
     try {
       await openConnectionPage(platform);
     } catch {
       const url = getConnectionUrl(platform);
-      p.log.warn("Could not open browser automatically.");
-      p.note(url, "Open manually");
+      p2.log.warn("Could not open browser automatically.");
+      p2.note(url, "Open manually");
     }
-    const spinner4 = p.spinner();
-    spinner4.start("Waiting for connection... (complete auth in browser)");
+    const spinner5 = p2.spinner();
+    spinner5.start("Waiting for connection... (complete auth in browser)");
     try {
       await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
-      spinner4.stop(`${label} connected!`);
-      p.log.success(`${pc2.green("\u2713")} ${label} is now available to your AI agents`);
+      spinner5.stop(`${label} connected!`);
+      p2.log.success(`${pc3.green("\u2713")} ${label} is now available to your AI agents`);
       connected.push(platform);
       first = false;
     } catch (error) {
-      spinner4.stop("Connection timed out");
+      spinner5.stop("Connection timed out");
       if (error instanceof TimeoutError) {
-        p.log.warn(`No worries. Connect later with: ${pc2.cyan(`pica add ${platform}`)}`);
+        p2.log.warn(`No worries. Connect later with: ${pc3.cyan(`pica add ${platform}`)}`);
       }
       first = false;
     }
     if (TOP_INTEGRATIONS.every((i) => connected.includes(i.value))) {
-      p.log.success("All top integrations connected!");
+      p2.log.success("All top integrations connected!");
       break;
     }
   }
@@ -862,23 +1084,23 @@ function updateConfigAgents(agentId) {
 }
 
 // src/commands/connection.ts
-import * as p2 from "@clack/prompts";
-import pc3 from "picocolors";
+import * as p3 from "@clack/prompts";
+import pc4 from "picocolors";
 
 // src/lib/platforms.ts
 function findPlatform(platforms, query) {
   const normalizedQuery = query.toLowerCase().trim();
   const exact = platforms.find(
-    (p4) => p4.platform.toLowerCase() === normalizedQuery || p4.name.toLowerCase() === normalizedQuery
+    (p5) => p5.platform.toLowerCase() === normalizedQuery || p5.name.toLowerCase() === normalizedQuery
   );
   if (exact) return exact;
   return null;
 }
 function findSimilarPlatforms(platforms, query, limit = 3) {
   const normalizedQuery = query.toLowerCase().trim();
-  const scored = platforms.map((p4) => {
-    const name = p4.name.toLowerCase();
-    const slug = p4.platform.toLowerCase();
+  const scored = platforms.map((p5) => {
+    const name = p5.name.toLowerCase();
+    const slug = p5.platform.toLowerCase();
     let score = 0;
     if (name.includes(normalizedQuery) || slug.includes(normalizedQuery)) {
       score = 10;
@@ -887,7 +1109,7 @@ function findSimilarPlatforms(platforms, query, limit = 3) {
     } else {
       score = countMatchingChars(normalizedQuery, slug);
     }
-    return { platform: p4, score };
+    return { platform: p5, score };
   }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score).slice(0, limit);
   return scored.map((item) => item.platform);
 }
@@ -902,22 +1124,22 @@ function countMatchingChars(a, b) {
 
 // src/commands/connection.ts
 async function connectionAddCommand(platformArg) {
-  p2.intro(pc3.bgCyan(pc3.black(" Pica ")));
+  p3.intro(pc4.bgCyan(pc4.black(" Pica ")));
   const apiKey = getApiKey();
   if (!apiKey) {
-    p2.cancel("Not configured. Run `pica init` first.");
+    p3.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p2.spinner();
-  spinner4.start("Loading platforms...");
+  const spinner5 = p3.spinner();
+  spinner5.start("Loading platforms...");
   let platforms;
   try {
     platforms = await api.listPlatforms();
-    spinner4.stop(`${platforms.length} platforms available`);
+    spinner5.stop(`${platforms.length} platforms available`);
   } catch (error) {
-    spinner4.stop("Failed to load platforms");
-    p2.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner5.stop("Failed to load platforms");
+    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
   let platform;
@@ -928,29 +1150,29 @@ async function connectionAddCommand(platformArg) {
     } else {
       const similar = findSimilarPlatforms(platforms, platformArg);
       if (similar.length > 0) {
-        p2.log.warn(`Unknown platform: ${platformArg}`);
-        const suggestion = await p2.select({
+        p3.log.warn(`Unknown platform: ${platformArg}`);
+        const suggestion = await p3.select({
           message: "Did you mean:",
           options: [
             ...similar.map((s) => ({ value: s.platform, label: `${s.name} (${s.platform})` })),
             { value: "__other__", label: "None of these" }
           ]
         });
-        if (p2.isCancel(suggestion) || suggestion === "__other__") {
-          p2.note(`Run ${pc3.cyan("pica platforms")} to see all available platforms.`);
-          p2.cancel("Connection cancelled.");
+        if (p3.isCancel(suggestion) || suggestion === "__other__") {
+          p3.note(`Run ${pc4.cyan("pica platforms")} to see all available platforms.`);
+          p3.cancel("Connection cancelled.");
           process.exit(0);
         }
         platform = suggestion;
       } else {
-        p2.cancel(`Unknown platform: ${platformArg}
+        p3.cancel(`Unknown platform: ${platformArg}
 
-Run ${pc3.cyan("pica platforms")} to see available platforms.`);
+Run ${pc4.cyan("pica platforms")} to see available platforms.`);
         process.exit(1);
       }
     }
   } else {
-    const platformInput = await p2.text({
+    const platformInput = await p3.text({
       message: "Which platform do you want to connect?",
       placeholder: "gmail, slack, hubspot...",
       validate: (value) => {
@@ -958,51 +1180,51 @@ Run ${pc3.cyan("pica platforms")} to see available platforms.`);
         return void 0;
       }
     });
-    if (p2.isCancel(platformInput)) {
-      p2.cancel("Connection cancelled.");
+    if (p3.isCancel(platformInput)) {
+      p3.cancel("Connection cancelled.");
       process.exit(0);
     }
     const found = findPlatform(platforms, platformInput);
     if (found) {
       platform = found.platform;
     } else {
-      p2.cancel(`Unknown platform: ${platformInput}
+      p3.cancel(`Unknown platform: ${platformInput}
 
-Run ${pc3.cyan("pica platforms")} to see available platforms.`);
+Run ${pc4.cyan("pica platforms")} to see available platforms.`);
       process.exit(1);
     }
   }
   const url = getConnectionUrl(platform);
-  p2.log.info(`Opening browser to connect ${pc3.cyan(platform)}...`);
-  p2.note(pc3.dim(url), "URL");
+  p3.log.info(`Opening browser to connect ${pc4.cyan(platform)}...`);
+  p3.note(pc4.dim(url), "URL");
   try {
     await openConnectionPage(platform);
   } catch {
-    p2.log.warn("Could not open browser automatically.");
-    p2.note(`Open this URL manually:
+    p3.log.warn("Could not open browser automatically.");
+    p3.note(`Open this URL manually:
 ${url}`);
   }
-  const pollSpinner = p2.spinner();
+  const pollSpinner = p3.spinner();
   pollSpinner.start("Waiting for connection... (complete auth in browser)");
   try {
     const connection2 = await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
     pollSpinner.stop(`${platform} connected!`);
-    p2.log.success(`${pc3.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
-    p2.outro("Connection complete!");
+    p3.log.success(`${pc4.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
+    p3.outro("Connection complete!");
   } catch (error) {
     pollSpinner.stop("Connection timed out");
     if (error instanceof TimeoutError) {
-      p2.note(
+      p3.note(
         `Possible issues:
   - OAuth flow was not completed in the browser
   - Browser popup was blocked
   - Wrong account selected
 
-Try again with: ${pc3.cyan(`pica connection add ${platform}`)}`,
+Try again with: ${pc4.cyan(`pica connection add ${platform}`)}`,
         "Timed Out"
       );
     } else {
-      p2.log.error(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+      p3.log.error(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     }
     process.exit(1);
   }
@@ -1010,20 +1232,20 @@ Try again with: ${pc3.cyan(`pica connection add ${platform}`)}`,
 async function connectionListCommand() {
   const apiKey = getApiKey();
   if (!apiKey) {
-    p2.cancel("Not configured. Run `pica init` first.");
+    p3.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p2.spinner();
-  spinner4.start("Loading connections...");
+  const spinner5 = p3.spinner();
+  spinner5.start("Loading connections...");
   try {
     const connections = await api.listConnections();
-    spinner4.stop(`${connections.length} connection${connections.length === 1 ? "" : "s"} found`);
+    spinner5.stop(`${connections.length} connection${connections.length === 1 ? "" : "s"} found`);
     if (connections.length === 0) {
-      p2.note(
+      p3.note(
         `No connections yet.
 
-Add one with: ${pc3.cyan("pica connection add gmail")}`,
+Add one with: ${pc4.cyan("pica connection add gmail")}`,
         "No Connections"
       );
       return;
@@ -1040,46 +1262,46 @@ Add one with: ${pc3.cyan("pica connection add gmail")}`,
         { key: "status", label: "" },
         { key: "platform", label: "Platform" },
         { key: "state", label: "Status" },
-        { key: "key", label: "Connection Key", color: pc3.dim }
+        { key: "key", label: "Connection Key", color: pc4.dim }
       ],
       rows
     );
     console.log();
-    p2.note(`Add more with: ${pc3.cyan("pica connection add <platform>")}`, "Tip");
+    p3.note(`Add more with: ${pc4.cyan("pica connection add <platform>")}`, "Tip");
   } catch (error) {
-    spinner4.stop("Failed to load connections");
-    p2.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner5.stop("Failed to load connections");
+    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
 }
 function getStatusIndicator(state) {
   switch (state) {
     case "operational":
-      return pc3.green("\u25CF");
+      return pc4.green("\u25CF");
     case "degraded":
-      return pc3.yellow("\u25CF");
+      return pc4.yellow("\u25CF");
     case "failed":
-      return pc3.red("\u25CF");
+      return pc4.red("\u25CF");
     default:
-      return pc3.dim("\u25CB");
+      return pc4.dim("\u25CB");
   }
 }
 
 // src/commands/platforms.ts
-import * as p3 from "@clack/prompts";
-import pc4 from "picocolors";
+import * as p4 from "@clack/prompts";
+import pc5 from "picocolors";
 async function platformsCommand(options) {
   const apiKey = getApiKey();
   if (!apiKey) {
-    p3.cancel("Not configured. Run `pica init` first.");
+    p4.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p3.spinner();
-  spinner4.start("Loading platforms...");
+  const spinner5 = p4.spinner();
+  spinner5.start("Loading platforms...");
   try {
     const platforms = await api.listPlatforms();
-    spinner4.stop(`${platforms.length} platforms available`);
+    spinner5.stop(`${platforms.length} platforms available`);
     if (options.json) {
       console.log(JSON.stringify(platforms, null, 2));
       return;
@@ -1097,7 +1319,7 @@ async function platformsCommand(options) {
       const categoryPlatforms = byCategory.get(options.category);
       if (!categoryPlatforms) {
         const categories = [...byCategory.keys()].sort();
-        p3.note(`Available categories:
+        p4.note(`Available categories:
   ${categories.join(", ")}`, "Unknown Category");
         process.exit(1);
       }
@@ -1129,10 +1351,10 @@ async function platformsCommand(options) {
       );
     }
     console.log();
-    p3.note(`Connect with: ${pc4.cyan("pica connection add <platform>")}`, "Tip");
+    p4.note(`Connect with: ${pc5.cyan("pica connection add <platform>")}`, "Tip");
   } catch (error) {
-    spinner4.stop("Failed to load platforms");
-    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner5.stop("Failed to load platforms");
+    p4.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
 }
@@ -1145,6 +1367,9 @@ program.name("pica").description("CLI for managing Pica").version(version);
 program.command("init").description("Set up Pica and install MCP to your AI agents").option("-y, --yes", "Skip confirmations").option("-g, --global", "Install MCP globally (available in all projects)").option("-p, --project", "Install MCP for this project only (creates .mcp.json)").action(async (options) => {
   await initCommand(options);
 });
+program.command("config").description("Configure MCP access control (permissions, connections, actions)").action(async () => {
+  await configCommand();
+});
 var connection = program.command("connection").description("Manage connections");
 connection.command("add [platform]").alias("a").description("Add a new connection").action(async (platform) => {
   await connectionAddCommand(platform);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@picahq/cli",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "CLI for managing Pica",
   "type": "module",
   "files": [