@picahq/cli 1.7.0 → 1.9.0

package/dist/index.js

@@ -5,8 +5,8 @@ import { createRequire } from "module";
 import { Command } from "commander";
 
 // src/commands/init.ts
-import * as p from "@clack/prompts";
-import pc2 from "picocolors";
+import * as p2 from "@clack/prompts";
+import pc3 from "picocolors";
 
 // src/lib/config.ts
 import fs from "fs";
@@ -41,17 +41,43 @@ function getApiKey() {
   const config = readConfig();
   return config?.apiKey ?? null;
 }
+function getAccessControl() {
+  return readConfig()?.accessControl ?? {};
+}
+function updateAccessControl(settings) {
+  const config = readConfig();
+  if (!config) return;
+  const cleaned = {};
+  if (settings.permissions && settings.permissions !== "admin") {
+    cleaned.permissions = settings.permissions;
+  }
+  if (settings.connectionKeys && !(settings.connectionKeys.length === 1 && settings.connectionKeys[0] === "*")) {
+    cleaned.connectionKeys = settings.connectionKeys;
+  }
+  if (settings.actionIds && !(settings.actionIds.length === 1 && settings.actionIds[0] === "*")) {
+    cleaned.actionIds = settings.actionIds;
+  }
+  if (settings.knowledgeAgent) {
+    cleaned.knowledgeAgent = true;
+  }
+  if (Object.keys(cleaned).length === 0) {
+    delete config.accessControl;
+  } else {
+    config.accessControl = cleaned;
+  }
+  writeConfig(config);
+}
 
 // src/lib/agents.ts
 import fs2 from "fs";
 import path2 from "path";
 import os2 from "os";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
-function expandPath(p4) {
-  if (p4.startsWith("~/")) {
-    return path2.join(os2.homedir(), p4.slice(2));
+function expandPath(p6) {
+  if (p6.startsWith("~/")) {
+    return path2.join(os2.homedir(), p6.slice(2));
   }
-  return p4;
+  return p6;
 }
 function getClaudeDesktopConfigPath() {
   switch (process.platform) {
@@ -179,20 +205,35 @@ function writeAgentConfig(agent, config, scope = "global") {
     fs2.writeFileSync(configPath, JSON.stringify(config, null, 2));
   }
 }
-function getMcpServerConfig(apiKey) {
+function getMcpServerConfig(apiKey, accessControl) {
+  const env = {
+    PICA_SECRET: apiKey
+  };
+  if (accessControl) {
+    if (accessControl.permissions && accessControl.permissions !== "admin") {
+      env.PICA_PERMISSIONS = accessControl.permissions;
+    }
+    if (accessControl.connectionKeys && !(accessControl.connectionKeys.length === 1 && accessControl.connectionKeys[0] === "*")) {
+      env.PICA_CONNECTION_KEYS = accessControl.connectionKeys.join(",");
+    }
+    if (accessControl.actionIds && !(accessControl.actionIds.length === 1 && accessControl.actionIds[0] === "*")) {
+      env.PICA_ACTION_IDS = accessControl.actionIds.join(",");
+    }
+    if (accessControl.knowledgeAgent) {
+      env.PICA_KNOWLEDGE_AGENT = "true";
+    }
+  }
   return {
     command: "npx",
     args: ["-y", "@picahq/mcp"],
-    env: {
-      PICA_SECRET: apiKey
-    }
+    env
   };
 }
-function installMcpConfig(agent, apiKey, scope = "global") {
+function installMcpConfig(agent, apiKey, scope = "global", accessControl) {
   const config = readAgentConfig(agent, scope);
   const configKey = agent.configKey;
   const mcpServers = config[configKey] || {};
-  mcpServers["pica"] = getMcpServerConfig(apiKey);
+  mcpServers["pica"] = getMcpServerConfig(apiKey, accessControl);
   config[configKey] = mcpServers;
   writeAgentConfig(agent, config, scope);
 }
@@ -247,8 +288,8 @@ var PicaApi = class {
     }
     const response = await fetch(url, fetchOpts);
     if (!response.ok) {
-      const text3 = await response.text();
-      throw new ApiError(response.status, text3 || `HTTP ${response.status}`);
+      const text4 = await response.text();
+      throw new ApiError(response.status, text4 || `HTTP ${response.status}`);
     }
     return response.json();
   }
@@ -279,6 +320,140 @@ var PicaApi = class {
     } while (page <= totalPages);
     return allPlatforms;
   }
+  async searchActions(platform, query, agentType) {
+    const isKnowledgeAgent = !agentType || agentType === "knowledge";
+    const queryParams = {
+      query,
+      limit: "5"
+    };
+    if (isKnowledgeAgent) {
+      queryParams.knowledgeAgent = "true";
+    } else {
+      queryParams.executeAgent = "true";
+    }
+    const response = await this.requestFull({
+      path: `/available-actions/search/${platform}`,
+      queryParams
+    });
+    return response || [];
+  }
+  async getActionDetails(actionId) {
+    const response = await this.requestFull({
+      path: "/knowledge",
+      queryParams: { _id: actionId }
+    });
+    const actions2 = response?.rows || [];
+    if (actions2.length === 0) {
+      throw new ApiError(404, `Action with ID ${actionId} not found`);
+    }
+    return actions2[0];
+  }
+  async getActionKnowledge(actionId) {
+    const action = await this.getActionDetails(actionId);
+    if (!action.knowledge || !action.method) {
+      return {
+        knowledge: "No knowledge was found",
+        method: "No method was found"
+      };
+    }
+    return {
+      knowledge: action.knowledge,
+      method: action.method
+    };
+  }
+  async executePassthroughRequest(args, preloadedAction) {
+    const action = preloadedAction ?? await this.getActionDetails(args.actionId);
+    const method = action.method;
+    const contentType = args.isFormData ? "multipart/form-data" : args.isFormUrlEncoded ? "application/x-www-form-urlencoded" : "application/json";
+    const requestHeaders = {
+      "x-pica-secret": this.apiKey,
+      "x-pica-connection-key": args.connectionKey,
+      "x-pica-action-id": action._id,
+      "Content-Type": contentType,
+      ...args.headers
+    };
+    const finalActionPath = args.pathVariables ? replacePathVariables(action.path, args.pathVariables) : action.path;
+    const normalizedPath = finalActionPath.startsWith("/") ? finalActionPath : `/${finalActionPath}`;
+    const url = `${API_BASE.replace("/v1", "")}/v1/passthrough${normalizedPath}`;
+    const isCustomAction = action.tags?.includes("custom");
+    let requestData = args.data;
+    if (isCustomAction && method?.toLowerCase() !== "get") {
+      requestData = {
+        ...args.data,
+        connectionKey: args.connectionKey
+      };
+    }
+    let queryString = "";
+    if (args.queryParams && Object.keys(args.queryParams).length > 0) {
+      const params = new URLSearchParams(
+        Object.entries(args.queryParams).map(([k, v]) => [k, String(v)])
+      );
+      queryString = `?${params.toString()}`;
+    }
+    const fullUrl = `${url}${queryString}`;
+    const fetchOpts = {
+      method,
+      headers: requestHeaders
+    };
+    if (method?.toLowerCase() !== "get" && requestData !== void 0) {
+      if (args.isFormUrlEncoded) {
+        const params = new URLSearchParams();
+        if (requestData && typeof requestData === "object" && !Array.isArray(requestData)) {
+          Object.entries(requestData).forEach(([key, value]) => {
+            if (typeof value === "object") {
+              params.append(key, JSON.stringify(value));
+            } else {
+              params.append(key, String(value));
+            }
+          });
+        }
+        fetchOpts.body = params.toString();
+      } else if (args.isFormData) {
+        const boundary = `----FormBoundary${Date.now()}`;
+        requestHeaders["Content-Type"] = `multipart/form-data; boundary=${boundary}`;
+        let body = "";
+        if (requestData && typeof requestData === "object" && !Array.isArray(requestData)) {
+          Object.entries(requestData).forEach(([key, value]) => {
+            body += `--${boundary}\r
+`;
+            body += `Content-Disposition: form-data; name="${key}"\r
+\r
+`;
+            body += typeof value === "object" ? JSON.stringify(value) : String(value);
+            body += "\r\n";
+          });
+        }
+        body += `--${boundary}--\r
+`;
+        fetchOpts.body = body;
+        fetchOpts.headers = requestHeaders;
+      } else {
+        fetchOpts.body = JSON.stringify(requestData);
+      }
+    }
+    const sanitizedConfig = {
+      url: fullUrl,
+      method,
+      headers: {
+        ...requestHeaders,
+        "x-pica-secret": "***REDACTED***"
+      },
+      params: args.queryParams ? Object.fromEntries(
+        Object.entries(args.queryParams).map(([k, v]) => [k, String(v)])
+      ) : void 0,
+      data: requestData
+    };
+    const response = await fetch(fullUrl, fetchOpts);
+    if (!response.ok) {
+      const text4 = await response.text();
+      throw new ApiError(response.status, text4 || `HTTP ${response.status}`);
+    }
+    const responseData = await response.json();
+    return {
+      requestConfig: sanitizedConfig,
+      responseData
+    };
+  }
   async waitForConnection(platform, timeoutMs = 5 * 60 * 1e3, pollIntervalMs = 5e3, onPoll) {
     const startTime = Date.now();
     const existingConnections = await this.listConnections();
@@ -306,6 +481,72 @@ var TimeoutError = class extends Error {
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
+function replacePathVariables(path3, variables) {
+  if (!path3) return path3;
+  let result = path3;
+  result = result.replace(/\{\{([^}]+)\}\}/g, (_match, variable) => {
+    const trimmedVariable = variable.trim();
+    const value = variables[trimmedVariable];
+    if (value === void 0 || value === null || value === "") {
+      throw new Error(`Missing value for path variable: ${trimmedVariable}`);
+    }
+    return encodeURIComponent(value.toString());
+  });
+  result = result.replace(/\{([^}]+)\}/g, (_match, variable) => {
+    const trimmedVariable = variable.trim();
+    const value = variables[trimmedVariable];
+    if (value === void 0 || value === null || value === "") {
+      throw new Error(`Missing value for path variable: ${trimmedVariable}`);
+    }
+    return encodeURIComponent(value.toString());
+  });
+  return result;
+}
+var PERMISSION_METHODS = {
+  read: ["GET"],
+  write: ["GET", "POST", "PUT", "PATCH"],
+  admin: null
+};
+function filterByPermissions(actions2, permissions) {
+  const allowed = PERMISSION_METHODS[permissions];
+  if (allowed === null) return actions2;
+  return actions2.filter((a) => allowed.includes(a.method.toUpperCase()));
+}
+function isMethodAllowed(method, permissions) {
+  const allowed = PERMISSION_METHODS[permissions];
+  if (allowed === null) return true;
+  return allowed.includes(method.toUpperCase());
+}
+function isActionAllowed(actionId, allowedActionIds) {
+  return allowedActionIds.includes("*") || allowedActionIds.includes(actionId);
+}
+function buildActionKnowledgeWithGuidance(knowledge, method, platform, actionId) {
+  const baseUrl = "https://api.picaos.com";
+  return `${knowledge}
+
+API REQUEST STRUCTURE
+======================
+URL: ${baseUrl}/v1/passthrough/{{PATH}}
+
+IMPORTANT: When constructing the URL, only include the API endpoint path after the base URL.
+Do NOT include the full third-party API URL.
+
+Examples:
+  Correct: ${baseUrl}/v1/passthrough/crm/v3/objects/contacts/search
+  Incorrect: ${baseUrl}/v1/passthrough/https://api.hubapi.com/crm/v3/objects/contacts/search
+
+METHOD: ${method}
+
+HEADERS:
+- x-pica-secret: {{process.env.PICA_SECRET}}
+- x-pica-connection-key: {{process.env.PICA_${platform.toUpperCase()}_CONNECTION_KEY}}
+- x-pica-action-id: ${actionId}
+- ... (other headers)
+
+BODY: {{BODY}}
+
+QUERY PARAMS: {{QUERY_PARAMS}}`;
+}
 
 // src/lib/browser.ts
 import open from "open";
@@ -324,11 +565,171 @@ async function openApiKeyPage() {
   await open(getApiKeyUrl());
 }
 
+// src/commands/config.ts
+import * as p from "@clack/prompts";
+import pc from "picocolors";
+async function configCommand() {
+  const config = readConfig();
+  if (!config) {
+    p.log.error(`No Pica config found. Run ${pc.cyan("pica init")} first.`);
+    return;
+  }
+  p.intro(pc.bgCyan(pc.black(" Pica Access Control ")));
+  const current = getAccessControl();
+  console.log();
+  console.log(`  ${pc.bold("Current Access Control")}`);
+  console.log(`  ${pc.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc.dim("Permissions:")}   ${current.permissions ?? "admin"}`);
+  console.log(`  ${pc.dim("Connections:")}   ${formatList(current.connectionKeys)}`);
+  console.log(`  ${pc.dim("Action IDs:")}    ${formatList(current.actionIds)}`);
+  console.log(`  ${pc.dim("Knowledge only:")} ${current.knowledgeAgent ? "yes" : "no"}`);
+  console.log();
+  const permissions = await p.select({
+    message: "Permission level",
+    options: [
+      { value: "admin", label: "Admin", hint: "Full access (GET, POST, PUT, PATCH, DELETE)" },
+      { value: "write", label: "Write", hint: "GET, POST, PUT, PATCH" },
+      { value: "read", label: "Read", hint: "GET only" }
+    ],
+    initialValue: current.permissions ?? "admin"
+  });
+  if (p.isCancel(permissions)) {
+    p.outro("No changes made.");
+    return;
+  }
+  const connectionMode = await p.select({
+    message: "Connection scope",
+    options: [
+      { value: "all", label: "All connections" },
+      { value: "specific", label: "Select specific connections" }
+    ],
+    initialValue: current.connectionKeys ? "specific" : "all"
+  });
+  if (p.isCancel(connectionMode)) {
+    p.outro("No changes made.");
+    return;
+  }
+  let connectionKeys;
+  if (connectionMode === "specific") {
+    connectionKeys = await selectConnections(config.apiKey);
+    if (connectionKeys === void 0) {
+      p.outro("No changes made.");
+      return;
+    }
+    if (connectionKeys.length === 0) {
+      p.log.info(`No connections found. Defaulting to all. Use ${pc.cyan("pica add")} to connect platforms.`);
+      connectionKeys = void 0;
+    }
+  }
+  const actionMode = await p.select({
+    message: "Action scope",
+    options: [
+      { value: "all", label: "All actions" },
+      { value: "specific", label: "Restrict to specific action IDs" }
+    ],
+    initialValue: current.actionIds ? "specific" : "all"
+  });
+  if (p.isCancel(actionMode)) {
+    p.outro("No changes made.");
+    return;
+  }
+  let actionIds;
+  if (actionMode === "specific") {
+    const actionInput = await p.text({
+      message: "Enter action IDs (comma-separated):",
+      placeholder: "action-id-1, action-id-2",
+      initialValue: current.actionIds?.join(", ") ?? "",
+      validate: (value) => {
+        if (!value.trim()) return "At least one action ID is required";
+        return void 0;
+      }
+    });
+    if (p.isCancel(actionInput)) {
+      p.outro("No changes made.");
+      return;
+    }
+    actionIds = actionInput.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  const knowledgeAgent = await p.confirm({
+    message: "Enable knowledge-only mode? (disables action execution)",
+    initialValue: current.knowledgeAgent ?? false
+  });
+  if (p.isCancel(knowledgeAgent)) {
+    p.outro("No changes made.");
+    return;
+  }
+  const settings = {
+    permissions,
+    connectionKeys: connectionKeys ?? ["*"],
+    actionIds: actionIds ?? ["*"],
+    knowledgeAgent
+  };
+  updateAccessControl(settings);
+  const ac = getAccessControl();
+  const statuses = getAgentStatuses();
+  const reinstalled = [];
+  for (const s of statuses) {
+    if (s.globalMcp) {
+      installMcpConfig(s.agent, config.apiKey, "global", ac);
+      reinstalled.push(`${s.agent.name} (global)`);
+    }
+    if (s.projectMcp) {
+      installMcpConfig(s.agent, config.apiKey, "project", ac);
+      reinstalled.push(`${s.agent.name} (project)`);
+    }
+  }
+  if (reinstalled.length > 0) {
+    p.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
+  }
+  p.outro("Access control updated.");
+}
+async function selectConnections(apiKey) {
+  const spinner6 = p.spinner();
+  spinner6.start("Fetching connections...");
+  let connections;
+  try {
+    const api = new PicaApi(apiKey);
+    const rawConnections = await api.listConnections();
+    connections = rawConnections.map((c) => ({ platform: c.platform, key: c.key }));
+    spinner6.stop(`Found ${connections.length} connection(s)`);
+  } catch {
+    spinner6.stop("Could not fetch connections");
+    const manual = await p.text({
+      message: "Enter connection keys manually (comma-separated):",
+      placeholder: "conn_key_1, conn_key_2",
+      validate: (value) => {
+        if (!value.trim()) return "At least one connection key is required";
+        return void 0;
+      }
+    });
+    if (p.isCancel(manual)) return void 0;
+    return manual.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  if (connections.length === 0) {
+    return [];
+  }
+  const selected = await p.multiselect({
+    message: "Select connections:",
+    options: connections.map((c) => ({
+      value: c.key,
+      label: `${c.platform}`,
+      hint: c.key
+    }))
+  });
+  if (p.isCancel(selected)) return void 0;
+  return selected;
+}
+function formatList(list) {
+  if (!list || list.length === 0) return "all";
+  if (list.length === 1 && list[0] === "*") return "all";
+  return list.join(", ");
+}
+
 // src/commands/init.ts
 import open2 from "open";
 
 // src/lib/table.ts
-import pc from "picocolors";
+import pc2 from "picocolors";
 function printTable(columns, rows) {
   if (rows.length === 0) return;
   const gap = "  ";
@@ -340,10 +741,10 @@ function printTable(columns, rows) {
   });
   const header = columns.map((col, i) => {
     const padded = col.align === "right" ? col.label.padStart(widths[i]) : col.label.padEnd(widths[i]);
-    return pc.dim(padded);
+    return pc2.dim(padded);
   }).join(gap);
   console.log(`${indent}${header}`);
-  const separator = columns.map((_, i) => pc.dim("\u2500".repeat(widths[i]))).join(gap);
+  const separator = columns.map((_, i) => pc2.dim("\u2500".repeat(widths[i]))).join(gap);
   console.log(`${indent}${separator}`);
   for (const row of rows) {
     const line = columns.map((col, i) => {
@@ -367,7 +768,7 @@ function stripAnsi(str) {
 async function initCommand(options) {
   const existingConfig = readConfig();
   if (existingConfig) {
-    p.intro(pc2.bgCyan(pc2.black(" Pica ")));
+    p2.intro(pc3.bgCyan(pc3.black(" Pica ")));
     await handleExistingConfig(existingConfig.apiKey, options);
     return;
   }
@@ -378,10 +779,10 @@ async function handleExistingConfig(apiKey, options) {
   const statuses = getAgentStatuses();
   const masked = maskApiKey(apiKey);
   console.log();
-  console.log(`  ${pc2.bold("Current Setup")}`);
-  console.log(`  ${pc2.dim("\u2500".repeat(42))}`);
-  console.log(`  ${pc2.dim("API Key:")}  ${masked}`);
-  console.log(`  ${pc2.dim("Config:")}   ${getConfigPath()}`);
+  console.log(`  ${pc3.bold("Current Setup")}`);
+  console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
+  console.log(`  ${pc3.dim("API Key:")}  ${masked}`);
+  console.log(`  ${pc3.dim("Config:")}   ${getConfigPath()}`);
   console.log();
   printTable(
     [
@@ -391,15 +792,24 @@ async function handleExistingConfig(apiKey, options) {
     ],
     statuses.map((s) => ({
       agent: s.agent.name,
-      global: !s.detected ? pc2.dim("-") : s.globalMcp ? pc2.green("\u25CF yes") : pc2.yellow("\u25CB no"),
-      project: s.projectMcp === null ? pc2.dim("-") : s.projectMcp ? pc2.green("\u25CF yes") : pc2.yellow("\u25CB no")
+      global: !s.detected ? pc3.dim("-") : s.globalMcp ? pc3.green("\u25CF yes") : pc3.yellow("\u25CB no"),
+      project: s.projectMcp === null ? pc3.dim("-") : s.projectMcp ? pc3.green("\u25CF yes") : pc3.yellow("\u25CB no")
     }))
   );
   const notDetected = statuses.filter((s) => !s.detected);
   if (notDetected.length > 0) {
-    console.log(`  ${pc2.dim("- = not detected on this machine")}`);
+    console.log(`  ${pc3.dim("- = not detected on this machine")}`);
+  }
+  const ac = getAccessControl();
+  if (Object.keys(ac).length > 0) {
+    console.log(`  ${pc3.bold("Access Control")}`);
+    console.log(`  ${pc3.dim("\u2500".repeat(42))}`);
+    if (ac.permissions) console.log(`  ${pc3.dim("Permissions:")}   ${ac.permissions}`);
+    if (ac.connectionKeys) console.log(`  ${pc3.dim("Connections:")}   ${ac.connectionKeys.join(", ")}`);
+    if (ac.actionIds) console.log(`  ${pc3.dim("Action IDs:")}    ${ac.actionIds.join(", ")}`);
+    if (ac.knowledgeAgent) console.log(`  ${pc3.dim("Knowledge only:")} yes`);
+    console.log();
   }
-  console.log();
   const actionOptions = [];
   actionOptions.push({
     value: "update-key",
@@ -421,16 +831,21 @@ async function handleExistingConfig(apiKey, options) {
       hint: agentsMissingProject.map((s) => s.agent.name).join(", ")
     });
   }
+  actionOptions.push({
+    value: "access-control",
+    label: "Configure access control",
+    hint: "permissions, connections, actions"
+  });
   actionOptions.push({
     value: "start-fresh",
     label: "Start fresh (reconfigure everything)"
   });
-  const action = await p.select({
+  const action = await p2.select({
     message: "What would you like to do?",
     options: actionOptions
   });
-  if (p.isCancel(action)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(action)) {
+    p2.outro("No changes made.");
     return;
   }
   switch (action) {
@@ -443,26 +858,29 @@ async function handleExistingConfig(apiKey, options) {
     case "install-project":
       await handleInstallProject(apiKey, agentsMissingProject);
       break;
+    case "access-control":
+      await configCommand();
+      break;
     case "start-fresh":
       await freshSetup({ yes: true });
       break;
   }
 }
 async function handleUpdateKey(statuses) {
-  p.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, "API Key");
-  const openBrowser = await p.confirm({
+  p2.note(`Get your API key at:
+${pc3.cyan(getApiKeyUrl())}`, "API Key");
+  const openBrowser = await p2.confirm({
     message: "Open browser to get API key?",
     initialValue: true
   });
-  if (p.isCancel(openBrowser)) {
-    p.cancel("Cancelled.");
+  if (p2.isCancel(openBrowser)) {
+    p2.cancel("Cancelled.");
     process.exit(0);
   }
   if (openBrowser) {
     await openApiKeyPage();
   }
-  const newKey = await p.text({
+  const newKey = await p2.text({
     message: "Enter your new Pica API key:",
     placeholder: "sk_live_...",
     validate: (value) => {
@@ -473,28 +891,29 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       return void 0;
     }
   });
-  if (p.isCancel(newKey)) {
-    p.cancel("Cancelled.");
+  if (p2.isCancel(newKey)) {
+    p2.cancel("Cancelled.");
     process.exit(0);
   }
-  const spinner4 = p.spinner();
-  spinner4.start("Validating API key...");
+  const spinner6 = p2.spinner();
+  spinner6.start("Validating API key...");
   const api = new PicaApi(newKey);
   const isValid = await api.validateApiKey();
   if (!isValid) {
-    spinner4.stop("Invalid API key");
-    p.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+    spinner6.stop("Invalid API key");
+    p2.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
     process.exit(1);
   }
-  spinner4.stop("API key validated");
+  spinner6.stop("API key validated");
+  const ac = getAccessControl();
   const reinstalled = [];
   for (const s of statuses) {
     if (s.globalMcp) {
-      installMcpConfig(s.agent, newKey, "global");
+      installMcpConfig(s.agent, newKey, "global", ac);
       reinstalled.push(`${s.agent.name} (global)`);
     }
     if (s.projectMcp) {
-      installMcpConfig(s.agent, newKey, "project");
+      installMcpConfig(s.agent, newKey, "project", ac);
       reinstalled.push(`${s.agent.name} (project)`);
     }
   }
@@ -502,108 +921,111 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
   writeConfig({
     apiKey: newKey,
     installedAgents: config?.installedAgents ?? [],
-    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString()
+    createdAt: config?.createdAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+    accessControl: config?.accessControl
   });
   if (reinstalled.length > 0) {
-    p.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
+    p2.log.success(`Updated MCP configs: ${reinstalled.join(", ")}`);
   }
-  p.outro("API key updated.");
+  p2.outro("API key updated.");
 }
 async function handleInstallMore(apiKey, missing) {
+  const ac = getAccessControl();
   if (missing.length === 1) {
     const agent = missing[0].agent;
-    const confirm2 = await p.confirm({
+    const confirm3 = await p2.confirm({
       message: `Install Pica MCP to ${agent.name}?`,
       initialValue: true
     });
-    if (p.isCancel(confirm2) || !confirm2) {
-      p.outro("No changes made.");
+    if (p2.isCancel(confirm3) || !confirm3) {
+      p2.outro("No changes made.");
       return;
     }
-    installMcpConfig(agent, apiKey, "global");
+    installMcpConfig(agent, apiKey, "global", ac);
     updateConfigAgents(agent.id);
-    p.log.success(`${agent.name}: MCP installed`);
-    p.outro("Done.");
+    p2.log.success(`${agent.name}: MCP installed`);
+    p2.outro("Done.");
     return;
   }
-  const selected = await p.multiselect({
+  const selected = await p2.multiselect({
     message: "Select agents to install MCP:",
     options: missing.map((s) => ({
       value: s.agent.id,
       label: s.agent.name
     }))
   });
-  if (p.isCancel(selected)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(selected)) {
+    p2.outro("No changes made.");
     return;
   }
   const agents = missing.filter((s) => selected.includes(s.agent.id));
   for (const s of agents) {
-    installMcpConfig(s.agent, apiKey, "global");
+    installMcpConfig(s.agent, apiKey, "global", ac);
     updateConfigAgents(s.agent.id);
-    p.log.success(`${s.agent.name}: MCP installed`);
+    p2.log.success(`${s.agent.name}: MCP installed`);
   }
-  p.outro("Done.");
+  p2.outro("Done.");
 }
 async function handleInstallProject(apiKey, missing) {
+  const ac = getAccessControl();
   if (missing.length === 1) {
     const agent = missing[0].agent;
-    const confirm2 = await p.confirm({
+    const confirm3 = await p2.confirm({
       message: `Install project-level MCP for ${agent.name}?`,
       initialValue: true
     });
-    if (p.isCancel(confirm2) || !confirm2) {
-      p.outro("No changes made.");
+    if (p2.isCancel(confirm3) || !confirm3) {
+      p2.outro("No changes made.");
       return;
     }
-    installMcpConfig(agent, apiKey, "project");
+    installMcpConfig(agent, apiKey, "project", ac);
     const configPath = getAgentConfigPath(agent, "project");
-    p.log.success(`${agent.name}: ${configPath} created`);
-    p.note(
-      pc2.yellow("Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key."),
+    p2.log.success(`${agent.name}: ${configPath} created`);
+    p2.note(
+      pc3.yellow("Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key."),
       "Tip"
     );
-    p.outro("Done.");
+    p2.outro("Done.");
     return;
   }
-  const selected = await p.multiselect({
+  const selected = await p2.multiselect({
     message: "Select agents for project-level MCP:",
     options: missing.map((s) => ({
       value: s.agent.id,
       label: s.agent.name
     }))
   });
-  if (p.isCancel(selected)) {
-    p.outro("No changes made.");
+  if (p2.isCancel(selected)) {
+    p2.outro("No changes made.");
     return;
   }
   const agents = missing.filter((s) => selected.includes(s.agent.id));
   for (const s of agents) {
-    installMcpConfig(s.agent, apiKey, "project");
+    installMcpConfig(s.agent, apiKey, "project", ac);
     const configPath = getAgentConfigPath(s.agent, "project");
-    p.log.success(`${s.agent.name}: ${configPath} created`);
+    p2.log.success(`${s.agent.name}: ${configPath} created`);
   }
-  p.note(
-    pc2.yellow("Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key."),
+  p2.note(
+    pc3.yellow("Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key."),
     "Tip"
   );
-  p.outro("Done.");
+  p2.outro("Done.");
 }
 async function freshSetup(options) {
-  p.note(`Get your API key at:
-${pc2.cyan(getApiKeyUrl())}`, "API Key");
-  const openBrowser = await p.confirm({
+  p2.note(`Get your API key at:
+${pc3.cyan(getApiKeyUrl())}`, "API Key");
+  const openBrowser = await p2.confirm({
     message: "Open browser to get API key?",
     initialValue: true
   });
-  if (p.isCancel(openBrowser)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(openBrowser)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
   if (openBrowser) {
     await openApiKeyPage();
   }
-  const apiKey = await p.text({
+  const apiKey = await p2.text({
     message: "Enter your Pica API key:",
     placeholder: "sk_live_...",
     validate: (value) => {
@@ -614,27 +1036,27 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       return void 0;
     }
   });
-  if (p.isCancel(apiKey)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(apiKey)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
-  const spinner4 = p.spinner();
-  spinner4.start("Validating API key...");
+  const spinner6 = p2.spinner();
+  spinner6.start("Validating API key...");
   const api = new PicaApi(apiKey);
   const isValid = await api.validateApiKey();
   if (!isValid) {
-    spinner4.stop("Invalid API key");
-    p.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
+    spinner6.stop("Invalid API key");
+    p2.cancel(`Invalid API key. Get a valid key at ${getApiKeyUrl()}`);
     process.exit(1);
   }
-  spinner4.stop("API key validated");
+  spinner6.stop("API key validated");
   writeConfig({
     apiKey,
     installedAgents: [],
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
   const allAgents = getAllAgents();
-  const agentChoice = await p.select({
+  const agentChoice = await p2.select({
     message: "Where do you want to install the MCP?",
     options: [
       {
@@ -648,8 +1070,8 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
       }))
     ]
   });
-  if (p.isCancel(agentChoice)) {
-    p.cancel("Setup cancelled.");
+  if (p2.isCancel(agentChoice)) {
+    p2.cancel("Setup cancelled.");
     process.exit(0);
   }
   const selectedAgents = agentChoice === "all" ? allAgents : allAgents.filter((a) => a.id === agentChoice);
@@ -660,7 +1082,7 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
   } else if (options.project) {
     scope = "project";
   } else if (hasProjectScopeAgent) {
-    const scopeChoice = await p.select({
+    const scopeChoice = await p2.select({
       message: "How do you want to install it?",
       options: [
         {
@@ -675,8 +1097,8 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
         }
       ]
     });
-    if (p.isCancel(scopeChoice)) {
-      p.cancel("Setup cancelled.");
+    if (p2.isCancel(scopeChoice)) {
+      p2.cancel("Setup cancelled.");
       process.exit(0);
     }
     scope = scopeChoice;
@@ -686,12 +1108,12 @@ ${pc2.cyan(getApiKeyUrl())}`, "API Key");
     const nonProjectAgents = selectedAgents.filter((a) => !supportsProjectScope(a));
     if (projectAgents.length === 0) {
       const supported = allAgents.filter((a) => supportsProjectScope(a)).map((a) => a.name).join(", ");
-      p.note(
+      p2.note(
         `${selectedAgents.map((a) => a.name).join(", ")} does not support project-level MCP.
 Project scope is supported by: ${supported}`,
         "Not Supported"
       );
-      p.cancel("Run again and choose global scope or a different agent.");
+      p2.cancel("Run again and choose global scope or a different agent.");
       process.exit(1);
     }
     for (const agent of projectAgents) {
@@ -699,15 +1121,15 @@ Project scope is supported by: ${supported}`,
       installMcpConfig(agent, apiKey, "project");
       const configPath = getAgentConfigPath(agent, "project");
       const status = wasInstalled ? "updated" : "created";
-      p.log.success(`${agent.name}: ${configPath} ${status}`);
+      p2.log.success(`${agent.name}: ${configPath} ${status}`);
     }
     if (nonProjectAgents.length > 0) {
-      p.log.info(`Installing globally for agents without project scope support:`);
+      p2.log.info(`Installing globally for agents without project scope support:`);
       for (const agent of nonProjectAgents) {
         const wasInstalled = isMcpInstalled(agent, "global");
         installMcpConfig(agent, apiKey, "global");
         const status = wasInstalled ? "updated" : "installed";
-        p.log.success(`${agent.name}: MCP ${status} (global)`);
+        p2.log.success(`${agent.name}: MCP ${status} (global)`);
       }
     }
     const allInstalled = [...projectAgents, ...nonProjectAgents];
@@ -716,23 +1138,23 @@ Project scope is supported by: ${supported}`,
       installedAgents: allInstalled.map((a) => a.id),
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    const configPaths = projectAgents.map((a) => `  ${a.name}: ${pc2.dim(getAgentConfigPath(a, "project"))}`).join("\n");
-    let summary = `Config saved to: ${pc2.dim(getConfigPath())}
+    const configPaths = projectAgents.map((a) => `  ${a.name}: ${pc3.dim(getAgentConfigPath(a, "project"))}`).join("\n");
+    let summary = `Config saved to: ${pc3.dim(getConfigPath())}
 MCP configs:
 ${configPaths}
 
 `;
     if (nonProjectAgents.length > 0) {
-      const globalPaths = nonProjectAgents.map((a) => `  ${a.name}: ${pc2.dim(getAgentConfigPath(a, "global"))}`).join("\n");
+      const globalPaths = nonProjectAgents.map((a) => `  ${a.name}: ${pc3.dim(getAgentConfigPath(a, "global"))}`).join("\n");
       summary += `Global configs:
 ${globalPaths}
 
 `;
     }
-    summary += pc2.yellow("Note: Project config files can be committed to share with your team.\n") + pc2.yellow("Team members will need their own API key.");
-    p.note(summary, "Setup Complete");
+    summary += pc3.yellow("Note: Project config files can be committed to share with your team.\n") + pc3.yellow("Team members will need their own API key.");
+    p2.note(summary, "Setup Complete");
     await promptConnectIntegrations(apiKey);
-    p.outro("Your AI agents now have access to Pica integrations!");
+    p2.outro("Your AI agents now have access to Pica integrations!");
     return;
   }
   const installedAgentIds = [];
@@ -741,34 +1163,34 @@ ${globalPaths}
     installMcpConfig(agent, apiKey, "global");
     installedAgentIds.push(agent.id);
     const status = wasInstalled ? "updated" : "installed";
-    p.log.success(`${agent.name}: MCP ${status}`);
+    p2.log.success(`${agent.name}: MCP ${status}`);
   }
   writeConfig({
     apiKey,
     installedAgents: installedAgentIds,
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   });
-  p.note(
-    `Config saved to: ${pc2.dim(getConfigPath())}`,
+  p2.note(
+    `Config saved to: ${pc3.dim(getConfigPath())}`,
     "Setup Complete"
   );
   await promptConnectIntegrations(apiKey);
-  p.outro("Your AI agents now have access to Pica integrations!");
+  p2.outro("Your AI agents now have access to Pica integrations!");
 }
 function printBanner() {
   console.log();
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
-  console.log(pc2.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
+  console.log(pc3.cyan("  \u2588\u2588\u2588\u2588\u2588            \u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588"));
   console.log();
-  console.log(pc2.dim("  U N I V E R S A L   I N T E G R A T I O N S   F O R   A I"));
+  console.log(pc3.dim("  U N I V E R S A L   I N T E G R A T I O N S   F O R   A I"));
   console.log();
 }
 var TOP_INTEGRATIONS = [
@@ -802,48 +1224,48 @@ async function promptConnectIntegrations(apiKey) {
       { value: "skip", label: "Skip for now", hint: "you can always run pica add later" }
     ];
     const message = first ? "Connect your first integration?" : "Connect another?";
-    const choice = await p.select({ message, options });
-    if (p.isCancel(choice) || choice === "skip") {
+    const choice = await p2.select({ message, options });
+    if (p2.isCancel(choice) || choice === "skip") {
       break;
     }
     if (choice === "more") {
       try {
         await open2("https://app.picaos.com/connections");
-        p.log.info("Opened Pica dashboard in browser.");
+        p2.log.info("Opened Pica dashboard in browser.");
       } catch {
-        p.note("https://app.picaos.com/connections", "Open in browser");
+        p2.note("https://app.picaos.com/connections", "Open in browser");
       }
-      p.log.info(`Connect from the dashboard, or use ${pc2.cyan("pica add <platform>")}`);
+      p2.log.info(`Connect from the dashboard, or use ${pc3.cyan("pica add <platform>")}`);
       break;
     }
     const platform = choice;
     const integration = TOP_INTEGRATIONS.find((i) => i.value === platform);
     const label = integration?.label ?? platform;
-    p.log.info(`Opening browser to connect ${pc2.cyan(label)}...`);
+    p2.log.info(`Opening browser to connect ${pc3.cyan(label)}...`);
     try {
       await openConnectionPage(platform);
     } catch {
       const url = getConnectionUrl(platform);
-      p.log.warn("Could not open browser automatically.");
-      p.note(url, "Open manually");
+      p2.log.warn("Could not open browser automatically.");
+      p2.note(url, "Open manually");
     }
-    const spinner4 = p.spinner();
-    spinner4.start("Waiting for connection... (complete auth in browser)");
+    const spinner6 = p2.spinner();
+    spinner6.start("Waiting for connection... (complete auth in browser)");
     try {
       await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
-      spinner4.stop(`${label} connected!`);
-      p.log.success(`${pc2.green("\u2713")} ${label} is now available to your AI agents`);
+      spinner6.stop(`${label} connected!`);
+      p2.log.success(`${pc3.green("\u2713")} ${label} is now available to your AI agents`);
       connected.push(platform);
       first = false;
     } catch (error) {
-      spinner4.stop("Connection timed out");
+      spinner6.stop("Connection timed out");
       if (error instanceof TimeoutError) {
-        p.log.warn(`No worries. Connect later with: ${pc2.cyan(`pica add ${platform}`)}`);
+        p2.log.warn(`No worries. Connect later with: ${pc3.cyan(`pica add ${platform}`)}`);
       }
       first = false;
     }
     if (TOP_INTEGRATIONS.every((i) => connected.includes(i.value))) {
-      p.log.success("All top integrations connected!");
+      p2.log.success("All top integrations connected!");
       break;
     }
   }
@@ -862,23 +1284,23 @@ function updateConfigAgents(agentId) {
 }
 
 // src/commands/connection.ts
-import * as p2 from "@clack/prompts";
-import pc3 from "picocolors";
+import * as p3 from "@clack/prompts";
+import pc4 from "picocolors";
 
 // src/lib/platforms.ts
 function findPlatform(platforms, query) {
   const normalizedQuery = query.toLowerCase().trim();
   const exact = platforms.find(
-    (p4) => p4.platform.toLowerCase() === normalizedQuery || p4.name.toLowerCase() === normalizedQuery
+    (p6) => p6.platform.toLowerCase() === normalizedQuery || p6.name.toLowerCase() === normalizedQuery
   );
   if (exact) return exact;
   return null;
 }
 function findSimilarPlatforms(platforms, query, limit = 3) {
   const normalizedQuery = query.toLowerCase().trim();
-  const scored = platforms.map((p4) => {
-    const name = p4.name.toLowerCase();
-    const slug = p4.platform.toLowerCase();
+  const scored = platforms.map((p6) => {
+    const name = p6.name.toLowerCase();
+    const slug = p6.platform.toLowerCase();
     let score = 0;
     if (name.includes(normalizedQuery) || slug.includes(normalizedQuery)) {
       score = 10;
@@ -887,7 +1309,7 @@ function findSimilarPlatforms(platforms, query, limit = 3) {
     } else {
       score = countMatchingChars(normalizedQuery, slug);
     }
-    return { platform: p4, score };
+    return { platform: p6, score };
   }).filter((item) => item.score > 0).sort((a, b) => b.score - a.score).slice(0, limit);
   return scored.map((item) => item.platform);
 }
@@ -902,22 +1324,22 @@ function countMatchingChars(a, b) {
 
 // src/commands/connection.ts
 async function connectionAddCommand(platformArg) {
-  p2.intro(pc3.bgCyan(pc3.black(" Pica ")));
+  p3.intro(pc4.bgCyan(pc4.black(" Pica ")));
   const apiKey = getApiKey();
   if (!apiKey) {
-    p2.cancel("Not configured. Run `pica init` first.");
+    p3.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p2.spinner();
-  spinner4.start("Loading platforms...");
+  const spinner6 = p3.spinner();
+  spinner6.start("Loading platforms...");
   let platforms;
   try {
     platforms = await api.listPlatforms();
-    spinner4.stop(`${platforms.length} platforms available`);
+    spinner6.stop(`${platforms.length} platforms available`);
   } catch (error) {
-    spinner4.stop("Failed to load platforms");
-    p2.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner6.stop("Failed to load platforms");
+    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
   let platform;
@@ -928,29 +1350,29 @@ async function connectionAddCommand(platformArg) {
     } else {
       const similar = findSimilarPlatforms(platforms, platformArg);
       if (similar.length > 0) {
-        p2.log.warn(`Unknown platform: ${platformArg}`);
-        const suggestion = await p2.select({
+        p3.log.warn(`Unknown platform: ${platformArg}`);
+        const suggestion = await p3.select({
           message: "Did you mean:",
           options: [
             ...similar.map((s) => ({ value: s.platform, label: `${s.name} (${s.platform})` })),
             { value: "__other__", label: "None of these" }
           ]
         });
-        if (p2.isCancel(suggestion) || suggestion === "__other__") {
-          p2.note(`Run ${pc3.cyan("pica platforms")} to see all available platforms.`);
-          p2.cancel("Connection cancelled.");
+        if (p3.isCancel(suggestion) || suggestion === "__other__") {
+          p3.note(`Run ${pc4.cyan("pica platforms")} to see all available platforms.`);
+          p3.cancel("Connection cancelled.");
           process.exit(0);
         }
         platform = suggestion;
       } else {
-        p2.cancel(`Unknown platform: ${platformArg}
+        p3.cancel(`Unknown platform: ${platformArg}
 
-Run ${pc3.cyan("pica platforms")} to see available platforms.`);
+Run ${pc4.cyan("pica platforms")} to see available platforms.`);
         process.exit(1);
       }
     }
   } else {
-    const platformInput = await p2.text({
+    const platformInput = await p3.text({
       message: "Which platform do you want to connect?",
       placeholder: "gmail, slack, hubspot...",
       validate: (value) => {
@@ -958,51 +1380,51 @@ Run ${pc3.cyan("pica platforms")} to see available platforms.`);
         return void 0;
       }
     });
-    if (p2.isCancel(platformInput)) {
-      p2.cancel("Connection cancelled.");
+    if (p3.isCancel(platformInput)) {
+      p3.cancel("Connection cancelled.");
       process.exit(0);
     }
     const found = findPlatform(platforms, platformInput);
     if (found) {
       platform = found.platform;
     } else {
-      p2.cancel(`Unknown platform: ${platformInput}
+      p3.cancel(`Unknown platform: ${platformInput}
 
-Run ${pc3.cyan("pica platforms")} to see available platforms.`);
+Run ${pc4.cyan("pica platforms")} to see available platforms.`);
       process.exit(1);
     }
   }
   const url = getConnectionUrl(platform);
-  p2.log.info(`Opening browser to connect ${pc3.cyan(platform)}...`);
-  p2.note(pc3.dim(url), "URL");
+  p3.log.info(`Opening browser to connect ${pc4.cyan(platform)}...`);
+  p3.note(pc4.dim(url), "URL");
   try {
     await openConnectionPage(platform);
   } catch {
-    p2.log.warn("Could not open browser automatically.");
-    p2.note(`Open this URL manually:
+    p3.log.warn("Could not open browser automatically.");
+    p3.note(`Open this URL manually:
 ${url}`);
   }
-  const pollSpinner = p2.spinner();
+  const pollSpinner = p3.spinner();
   pollSpinner.start("Waiting for connection... (complete auth in browser)");
   try {
     const connection2 = await api.waitForConnection(platform, 5 * 60 * 1e3, 5e3);
     pollSpinner.stop(`${platform} connected!`);
-    p2.log.success(`${pc3.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
-    p2.outro("Connection complete!");
+    p3.log.success(`${pc4.green("\u2713")} ${connection2.platform} is now available to your AI agents.`);
+    p3.outro("Connection complete!");
   } catch (error) {
     pollSpinner.stop("Connection timed out");
     if (error instanceof TimeoutError) {
-      p2.note(
+      p3.note(
         `Possible issues:
   - OAuth flow was not completed in the browser
   - Browser popup was blocked
   - Wrong account selected
 
-Try again with: ${pc3.cyan(`pica connection add ${platform}`)}`,
+Try again with: ${pc4.cyan(`pica connection add ${platform}`)}`,
         "Timed Out"
       );
     } else {
-      p2.log.error(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+      p3.log.error(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     }
     process.exit(1);
   }
@@ -1010,20 +1432,20 @@ Try again with: ${pc3.cyan(`pica connection add ${platform}`)}`,
 async function connectionListCommand() {
   const apiKey = getApiKey();
   if (!apiKey) {
-    p2.cancel("Not configured. Run `pica init` first.");
+    p3.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p2.spinner();
-  spinner4.start("Loading connections...");
+  const spinner6 = p3.spinner();
+  spinner6.start("Loading connections...");
   try {
     const connections = await api.listConnections();
-    spinner4.stop(`${connections.length} connection${connections.length === 1 ? "" : "s"} found`);
+    spinner6.stop(`${connections.length} connection${connections.length === 1 ? "" : "s"} found`);
     if (connections.length === 0) {
-      p2.note(
+      p3.note(
         `No connections yet.
 
-Add one with: ${pc3.cyan("pica connection add gmail")}`,
+Add one with: ${pc4.cyan("pica connection add gmail")}`,
         "No Connections"
       );
       return;
@@ -1040,46 +1462,46 @@ Add one with: ${pc3.cyan("pica connection add gmail")}`,
         { key: "status", label: "" },
         { key: "platform", label: "Platform" },
         { key: "state", label: "Status" },
-        { key: "key", label: "Connection Key", color: pc3.dim }
+        { key: "key", label: "Connection Key", color: pc4.dim }
       ],
       rows
     );
     console.log();
-    p2.note(`Add more with: ${pc3.cyan("pica connection add <platform>")}`, "Tip");
+    p3.note(`Add more with: ${pc4.cyan("pica connection add <platform>")}`, "Tip");
   } catch (error) {
-    spinner4.stop("Failed to load connections");
-    p2.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner6.stop("Failed to load connections");
+    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
     process.exit(1);
   }
 }
 function getStatusIndicator(state) {
   switch (state) {
     case "operational":
-      return pc3.green("\u25CF");
+      return pc4.green("\u25CF");
     case "degraded":
-      return pc3.yellow("\u25CF");
+      return pc4.yellow("\u25CF");
     case "failed":
-      return pc3.red("\u25CF");
+      return pc4.red("\u25CF");
     default:
-      return pc3.dim("\u25CB");
+      return pc4.dim("\u25CB");
   }
 }
 
 // src/commands/platforms.ts
-import * as p3 from "@clack/prompts";
-import pc4 from "picocolors";
+import * as p4 from "@clack/prompts";
+import pc5 from "picocolors";
 async function platformsCommand(options) {
   const apiKey = getApiKey();
   if (!apiKey) {
-    p3.cancel("Not configured. Run `pica init` first.");
+    p4.cancel("Not configured. Run `pica init` first.");
     process.exit(1);
   }
   const api = new PicaApi(apiKey);
-  const spinner4 = p3.spinner();
-  spinner4.start("Loading platforms...");
+  const spinner6 = p4.spinner();
+  spinner6.start("Loading platforms...");
   try {
     const platforms = await api.listPlatforms();
-    spinner4.stop(`${platforms.length} platforms available`);
+    spinner6.stop(`${platforms.length} platforms available`);
     if (options.json) {
       console.log(JSON.stringify(platforms, null, 2));
       return;
@@ -1097,7 +1519,7 @@ async function platformsCommand(options) {
       const categoryPlatforms = byCategory.get(options.category);
       if (!categoryPlatforms) {
         const categories = [...byCategory.keys()].sort();
-        p3.note(`Available categories:
+        p4.note(`Available categories:
   ${categories.join(", ")}`, "Unknown Category");
         process.exit(1);
       }
@@ -1129,13 +1551,247 @@ async function platformsCommand(options) {
       );
     }
     console.log();
-    p3.note(`Connect with: ${pc4.cyan("pica connection add <platform>")}`, "Tip");
+    p4.note(`Connect with: ${pc5.cyan("pica connection add <platform>")}`, "Tip");
   } catch (error) {
-    spinner4.stop("Failed to load platforms");
-    p3.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    spinner6.stop("Failed to load platforms");
+    p4.cancel(`Error: ${error instanceof Error ? error.message : "Unknown error"}`);
+    process.exit(1);
+  }
+}
+
+// src/commands/actions.ts
+import * as p5 from "@clack/prompts";
+import pc6 from "picocolors";
+function getConfig() {
+  const apiKey = getApiKey();
+  if (!apiKey) {
+    p5.cancel("Not configured. Run `pica init` first.");
+    process.exit(1);
+  }
+  const ac = getAccessControl();
+  const permissions = ac.permissions || "admin";
+  const connectionKeys = ac.connectionKeys || ["*"];
+  const actionIds = ac.actionIds || ["*"];
+  const knowledgeAgent = ac.knowledgeAgent || false;
+  return { apiKey, permissions, connectionKeys, actionIds, knowledgeAgent };
+}
+async function actionsSearchCommand(platform, query, options) {
+  p5.intro(pc6.bgCyan(pc6.black(" Pica ")));
+  const { apiKey, permissions, actionIds, knowledgeAgent } = getConfig();
+  const api = new PicaApi(apiKey);
+  const spinner6 = p5.spinner();
+  spinner6.start(`Searching actions on ${pc6.cyan(platform)} for "${query}"...`);
+  try {
+    const agentType = knowledgeAgent ? "knowledge" : options.type;
+    let actions2 = await api.searchActions(platform, query, agentType);
+    actions2 = filterByPermissions(actions2, permissions);
+    actions2 = actions2.filter((a) => isActionAllowed(a.systemId, actionIds));
+    const cleanedActions = actions2.map((action) => ({
+      actionId: action.systemId,
+      title: action.title,
+      method: action.method,
+      path: action.path
+    }));
+    if (cleanedActions.length === 0) {
+      spinner6.stop("No actions found");
+      p5.note(
+        `No actions found for platform '${platform}' matching query '${query}'.
+
+Suggestions:
+  - Try a more general query (e.g., 'list', 'get', 'search', 'create')
+  - Verify the platform name is correct
+  - Check available platforms with ${pc6.cyan("pica platforms")}
+
+Examples of good queries:
+  - "search contacts"
+  - "send email"
+  - "create customer"
+  - "list orders"`,
+        "No Results"
+      );
+      return;
+    }
+    spinner6.stop(
+      `Found ${cleanedActions.length} action(s) for '${platform}' matching '${query}'`
+    );
+    console.log();
+    const rows = cleanedActions.map((a) => ({
+      method: colorMethod(a.method),
+      title: a.title,
+      actionId: a.actionId,
+      path: a.path
+    }));
+    printTable(
+      [
+        { key: "method", label: "Method" },
+        { key: "title", label: "Title" },
+        { key: "actionId", label: "Action ID", color: pc6.dim },
+        { key: "path", label: "Path", color: pc6.dim }
+      ],
+      rows
+    );
+    console.log();
+    p5.note(
+      `Get details: ${pc6.cyan(`pica actions knowledge ${platform} <actionId>`)}
+Execute:     ${pc6.cyan(`pica actions execute ${platform} <actionId> <connectionKey>`)}`,
+      "Next Steps"
+    );
+  } catch (error) {
+    spinner6.stop("Search failed");
+    p5.cancel(
+      `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+    process.exit(1);
+  }
+}
+async function actionsKnowledgeCommand(platform, actionId) {
+  p5.intro(pc6.bgCyan(pc6.black(" Pica ")));
+  const { apiKey, actionIds, connectionKeys } = getConfig();
+  const api = new PicaApi(apiKey);
+  if (!isActionAllowed(actionId, actionIds)) {
+    p5.cancel(`Action "${actionId}" is not in the allowed action list.`);
+    process.exit(1);
+  }
+  if (!connectionKeys.includes("*")) {
+    const spinner7 = p5.spinner();
+    spinner7.start("Checking connections...");
+    try {
+      const connections = await api.listConnections();
+      const connectedPlatforms = connections.map((c) => c.platform);
+      if (!connectedPlatforms.includes(platform)) {
+        spinner7.stop("Platform not connected");
+        p5.cancel(`Platform "${platform}" has no allowed connections.`);
+        process.exit(1);
+      }
+      spinner7.stop("Connection verified");
+    } catch (error) {
+      spinner7.stop("Failed to check connections");
+      p5.cancel(
+        `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+      );
+      process.exit(1);
+    }
+  }
+  const spinner6 = p5.spinner();
+  spinner6.start(`Loading knowledge for action ${pc6.dim(actionId)}...`);
+  try {
+    const { knowledge, method } = await api.getActionKnowledge(actionId);
+    const knowledgeWithGuidance = buildActionKnowledgeWithGuidance(
+      knowledge,
+      method,
+      platform,
+      actionId
+    );
+    spinner6.stop("Knowledge loaded");
+    console.log();
+    console.log(knowledgeWithGuidance);
+    console.log();
+    p5.note(
+      `Execute: ${pc6.cyan(`pica actions execute ${platform} ${actionId} <connectionKey>`)}`,
+      "Next Step"
+    );
+  } catch (error) {
+    spinner6.stop("Failed to load knowledge");
+    p5.cancel(
+      `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+    process.exit(1);
+  }
+}
+async function actionsExecuteCommand(platform, actionId, connectionKey, options) {
+  p5.intro(pc6.bgCyan(pc6.black(" Pica ")));
+  const { apiKey, permissions, actionIds, connectionKeys, knowledgeAgent } = getConfig();
+  if (knowledgeAgent) {
+    p5.cancel(
+      `Action execution is disabled (knowledge-only mode).
+Configure with: ${pc6.cyan("pica config")}`
+    );
+    process.exit(1);
+  }
+  if (!isActionAllowed(actionId, actionIds)) {
+    p5.cancel(`Action "${actionId}" is not in the allowed action list.`);
+    process.exit(1);
+  }
+  if (!connectionKeys.includes("*") && !connectionKeys.includes(connectionKey)) {
+    p5.cancel(`Connection key "${connectionKey}" is not allowed.`);
+    process.exit(1);
+  }
+  const api = new PicaApi(apiKey);
+  const spinner6 = p5.spinner();
+  spinner6.start("Loading action details...");
+  try {
+    const actionDetails = await api.getActionDetails(actionId);
+    if (!isMethodAllowed(actionDetails.method, permissions)) {
+      spinner6.stop("Permission denied");
+      p5.cancel(
+        `Method "${actionDetails.method}" is not allowed under "${permissions}" permission level.`
+      );
+      process.exit(1);
+    }
+    spinner6.stop(`Action: ${actionDetails.title} [${actionDetails.method}]`);
+    const data = options.data ? parseJsonArg(options.data, "--data") : void 0;
+    const pathVariables = options.pathVars ? parseJsonArg(options.pathVars, "--path-vars") : void 0;
+    const queryParams = options.queryParams ? parseJsonArg(options.queryParams, "--query-params") : void 0;
+    const headers = options.headers ? parseJsonArg(options.headers, "--headers") : void 0;
+    const execSpinner = p5.spinner();
+    execSpinner.start("Executing action...");
+    const result = await api.executePassthroughRequest(
+      {
+        platform,
+        actionId,
+        connectionKey,
+        data,
+        pathVariables,
+        queryParams,
+        headers,
+        isFormData: options.formData,
+        isFormUrlEncoded: options.formUrlEncoded
+      },
+      actionDetails
+    );
+    execSpinner.stop("Action executed successfully");
+    console.log();
+    console.log(pc6.dim("Request:"));
+    console.log(
+      pc6.dim(
+        `  ${result.requestConfig.method} ${result.requestConfig.url}`
+      )
+    );
+    console.log();
+    console.log(pc6.bold("Response:"));
+    console.log(JSON.stringify(result.responseData, null, 2));
+  } catch (error) {
+    spinner6.stop("Execution failed");
+    p5.cancel(
+      `Error: ${error instanceof Error ? error.message : "Unknown error"}`
+    );
+    process.exit(1);
+  }
+}
+function parseJsonArg(value, argName) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    p5.cancel(`Invalid JSON for ${argName}: ${value}`);
     process.exit(1);
   }
 }
+function colorMethod(method) {
+  switch (method.toUpperCase()) {
+    case "GET":
+      return pc6.green(method);
+    case "POST":
+      return pc6.yellow(method);
+    case "PUT":
+      return pc6.blue(method);
+    case "PATCH":
+      return pc6.magenta(method);
+    case "DELETE":
+      return pc6.red(method);
+    default:
+      return method;
+  }
+}
 
 // src/index.ts
 var require2 = createRequire(import.meta.url);
@@ -1145,6 +1801,9 @@ program.name("pica").description("CLI for managing Pica").version(version);
 program.command("init").description("Set up Pica and install MCP to your AI agents").option("-y, --yes", "Skip confirmations").option("-g, --global", "Install MCP globally (available in all projects)").option("-p, --project", "Install MCP for this project only (creates .mcp.json)").action(async (options) => {
   await initCommand(options);
 });
+program.command("config").description("Configure MCP access control (permissions, connections, actions)").action(async () => {
+  await configCommand();
+});
 var connection = program.command("connection").description("Manage connections");
 connection.command("add [platform]").alias("a").description("Add a new connection").action(async (platform) => {
   await connectionAddCommand(platform);
@@ -1155,6 +1814,23 @@ connection.command("list").alias("ls").description("List your connections").acti
 program.command("platforms").alias("p").description("List available platforms").option("-c, --category <category>", "Filter by category").option("--json", "Output as JSON").action(async (options) => {
   await platformsCommand(options);
 });
+var actions = program.command("actions").alias("a").description("Search, explore, and execute platform actions");
+actions.command("search <platform> <query>").description("Search for actions on a platform").option("-t, --type <type>", "Agent type: execute or knowledge (default: knowledge)").action(async (platform, query, options) => {
+  await actionsSearchCommand(platform, query, options);
+});
+actions.command("knowledge <platform> <actionId>").alias("k").description("Get detailed documentation for an action").action(async (platform, actionId) => {
+  await actionsKnowledgeCommand(platform, actionId);
+});
+actions.command("execute <platform> <actionId> <connectionKey>").alias("x").description("Execute an action on a connected platform").option("-d, --data <json>", "Request body as JSON").option("--path-vars <json>", "Path variables as JSON").option("--query-params <json>", "Query parameters as JSON").option("--headers <json>", "Additional headers as JSON").option("--form-data", "Send as multipart/form-data").option("--form-url-encoded", "Send as application/x-www-form-urlencoded").action(async (platform, actionId, connectionKey, options) => {
+  await actionsExecuteCommand(platform, actionId, connectionKey, {
+    data: options.data,
+    pathVars: options.pathVars,
+    queryParams: options.queryParams,
+    headers: options.headers,
+    formData: options.formData,
+    formUrlEncoded: options.formUrlEncoded
+  });
+});
 program.command("add [platform]").description("Shortcut for: connection add").action(async (platform) => {
   await connectionAddCommand(platform);
 });