@withone/cli 1.13.4 → 1.13.6

package/dist/{chunk-MCVD3QCG.js → chunk-T54OTDAW.js}

@@ -150,9 +150,17 @@ var OneApi = class {
     }
     let queryString = "";
     if (args.queryParams && Object.keys(args.queryParams).length > 0) {
-      const params = new URLSearchParams(
-        Object.entries(args.queryParams).map(([k, v]) => [k, String(v)])
-      );
+      const entries = [];
+      for (const [k, v] of Object.entries(args.queryParams)) {
+        if (Array.isArray(v)) {
+          for (const item of v) {
+            entries.push([k, String(item)]);
+          }
+        } else {
+          entries.push([k, String(v)]);
+        }
+      }
+      const params = new URLSearchParams(entries);
       queryString = `?${params.toString()}`;
     }
     const fullUrl = `${url}${queryString}`;
@@ -293,31 +301,30 @@ function isActionAllowed(actionId, allowedActionIds) {
   return allowedActionIds.includes("*") || allowedActionIds.includes(actionId);
 }
 function buildActionKnowledgeWithGuidance(knowledge, method, platform, actionId) {
-  const baseUrl = "https://api.withone.ai";
-  return `${knowledge}
-
-API REQUEST STRUCTURE
-======================
-URL: ${baseUrl}/v1/passthrough/{{PATH}}
+  return `CLI EXECUTION GUIDE (read this FIRST)
+========================================
+To execute this action, use the One CLI with SEPARATE flags for each parameter type.
+Do NOT pass path variables or query parameters in the -d body flag \u2014 this causes 403 errors.
 
-IMPORTANT: When constructing the URL, only include the API endpoint path after the base URL.
-Do NOT include the full third-party API URL.
+PARAMETER \u2192 FLAG MAPPING:
+- Path variables (URL placeholders like {userId}, {id}) \u2192 --path-vars '{"userId": "me"}'
+- Query parameters (filtering, pagination, format) \u2192 --query-params '{"key": "value"}'
+  - For repeated params, use arrays: --query-params '{"metadataHeaders": ["From", "Subject"]}'
+- Request body (POST/PUT/PATCH payload) \u2192 -d '{"field": "value"}'
 
-Examples:
-  Correct: ${baseUrl}/v1/passthrough/crm/v3/objects/contacts/search
-  Incorrect: ${baseUrl}/v1/passthrough/https://api.hubapi.com/crm/v3/objects/contacts/search
+EXAMPLE:
+one --agent actions execute ${platform} ${actionId} <connectionKey> \\
+  --path-vars '{ ... }' \\
+  --query-params '{ ... }' \\
+  -d '{ ... }'
 
-METHOD: ${method}
+Omit any flag not needed (e.g., omit --path-vars if URL has no placeholders, omit -d for GET).
 
-HEADERS:
-- x-one-secret: {{process.env.ONE_SECRET}}
-- x-one-connection-key: {{process.env.ONE_${platform.toUpperCase()}_CONNECTION_KEY}}
-- x-one-action-id: ${actionId}
-- ... (other headers)
+Read the API documentation below to identify which parameters are path variables, query parameters, or body fields, then map them to the correct flags above.
 
-BODY: {{BODY}}
+========================================
 
-QUERY PARAMS: {{QUERY_PARAMS}}`;
+${knowledge}`;
 }
 
 // src/lib/flow-engine.ts
@@ -655,7 +662,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlow: loadFlow2 } = await import("./flow-runner-EPSYHAD6.js");
+  const { loadFlow: loadFlow2 } = await import("./flow-runner-5ZBACWKL.js");
   const subFlow = loadFlow2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/{flow-runner-EPSYHAD6.js → flow-runner-5ZBACWKL.js}

@@ -4,7 +4,7 @@ import {
   loadFlow,
   resolveFlowPath,
   saveFlow
-} from "./chunk-MCVD3QCG.js";
+} from "./chunk-T54OTDAW.js";
 export {
   FlowRunner,
   listFlows,

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   loadFlow,
   resolveFlowPath,
   saveFlow
-} from "./chunk-MCVD3QCG.js";
+} from "./chunk-T54OTDAW.js";
 
 // src/index.ts
 import { createRequire as createRequire2 } from "module";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.13.4",
+  "version": "1.13.6",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one-actions/SKILL.md

@@ -78,7 +78,7 @@ one --agent actions knowledge <platform> <actionId>
 
 Get comprehensive documentation for an action including parameters, requirements, validation rules, request/response structure, and examples. Returns JSON with the full API knowledge and HTTP method.
 
-Always call this before executing — it tells you exactly what parameters are required and how to structure the request.
+Always call this before executing — it tells you exactly what parameters are required, how to structure the request, and which CLI flags to use for path variables, query parameters, and body data. Do NOT pass path or query parameters in the `-d` body flag.
 
 Example:
 ```bash
@@ -124,6 +124,11 @@ one --agent actions execute hub-spot <actionId> <connectionKey> \
 one --agent actions execute shopify <actionId> <connectionKey> \
   --path-vars '{"order_id": "12345"}' \
   --query-params '{"limit": "10"}'
+
+# With repeated query params (array values expand to repeated keys)
+one --agent actions execute gmail <actionId> <connectionKey> \
+  --path-vars '{"userId": "me", "id": "msg123"}' \
+  --query-params '{"format": "metadata", "metadataHeaders": ["From", "Subject", "Date"]}'
 ```
 
 Output format:
@@ -147,5 +152,6 @@ Parse the output as JSON. If the `error` key is present, the command failed —
 - Always use the **exact action ID** from search results — don't guess or construct them
 - Always read the knowledge output carefully — it tells you which parameters are required vs optional, what format they need to be in, and any caveats specific to that API
 - JSON values passed to `-d`, `--path-vars`, `--query-params`, and `--headers` must be valid JSON strings (use single quotes around the JSON to avoid shell escaping issues)
+- **Array query params**: Use JSON arrays for repeated query parameters — `{"metadataHeaders": ["From", "Subject"]}` expands to `metadataHeaders=From&metadataHeaders=Subject`
 - If search returns no results, try broader queries (e.g., `"list"` instead of `"list active premium customers"`)
 - The execute command respects access control settings configured via `one config` — if execution is blocked, the user may need to adjust their permissions