@withone/cli 1.27.0 → 1.28.0

package/README.md

@@ -391,6 +391,30 @@ Settings propagate automatically to all installed agent configs.
 
 Auto-sync refuses to resurrect skills if you opted out of skill installation during `one init` — the canonical dir has to already exist.
 
+### Project config (`.onerc`)
+
+Drop a `.onerc` file in your project root to override global settings per-project. Simple `KEY=VALUE` format; `#` for comments. Read from the current working directory (no parent lookup).
+
+| Key | Purpose |
+|-----|---------|
+| `ONE_SECRET` | API key (also honored as env var) |
+| `ONE_API_BASE` | API base URL (also honored as env var) |
+| `ONE_PERMISSIONS` | `admin` / `write` / `read` |
+| `ONE_CONNECTION_KEYS` | Comma-separated connection-key allowlist |
+| `ONE_ACTION_IDS` | Comma-separated action-ID allowlist |
+| `ONE_KNOWLEDGE_AGENT` | `true` / `false` — knowledge-only mode |
+
+Precedence: env var > `.onerc` > `~/.one/config.json`.
+
+```bash
+# .onerc
+ONE_SECRET=sk_live_xxx
+ONE_API_BASE=https://development-api.withone.ai
+ONE_PERMISSIONS=read
+```
+
+> ⚠️ **Add `.onerc` to your `.gitignore`.** If you put `ONE_SECRET` in it, committing the file will leak your API key. Treat `.onerc` like `.env` — never check it in.
+
 ## The workflow
 
 The power of One is in the workflow. Every interaction follows the same pattern:

package/dist/index.js

@@ -108,6 +108,10 @@ function getAccessControl() {
 }
 var DEFAULT_API_BASE = "https://api.withone.ai/v1";
 function getApiBase() {
+  const envBase = process.env.ONE_API_BASE;
+  if (envBase) return `${envBase.replace(/\/+$/, "").replace(/\/v1$/, "")}/v1`;
+  const rc = readOneRc();
+  if (rc.ONE_API_BASE) return `${rc.ONE_API_BASE.replace(/\/+$/, "").replace(/\/v1$/, "")}/v1`;
   const config2 = readConfig();
   if (config2?.apiBase) return `${config2.apiBase}/v1`;
   return DEFAULT_API_BASE;
@@ -2489,7 +2493,7 @@ function validateSelectorReferences(flow2) {
       for (const match of value.matchAll(SELECTOR_TOKEN_RE)) {
         selectors.push(match[0]);
       }
-      const interpolated = value.matchAll(/\{\{(\$\.[^}]+)\}\}/g);
+      const interpolated = value.matchAll(/\{\{\s*(?:q\s+)?(\$\.[^}\s|]+)/g);
       for (const match of interpolated) {
         selectors.push(match[1]);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "description": "CLI for managing One",
   "type": "module",
   "files": [