@withone/cli 2.4.0 → 2.5.0

package/README.md

@@ -185,7 +185,7 @@ Opens your browser, you authorize, done. The CLI polls until the connection is l
 
 ### `one list`
 
-List your active connections with their status, connection keys, and what your access config lets you run on each.
+List your active connections with their status, connection keys, and the access this key has on each.
 
 ```bash
 one list
@@ -199,15 +199,15 @@ one list
 
 You need the connection key (rightmost column) when executing actions.
 
-**Access reporting.** Every connection carries an `access` field describing what the current [access control](#one-config) config permits — so an agent knows its reach up front instead of discovering it as a failure mid-workflow. Three policies:
+**Access reporting.** Every connection carries an `access` field: what this key may run there. The CLI reads it from One (`GET /v1/access/me`, the access chosen on the consent page or later in the dashboard) and narrows it by any limits you set with [`one config`](#one-config) — the server's answer is the ceiling, local settings can only lower it.
 
-| Policy | Means | Shown when |
-|--------|-------|-----------|
-| `{"policy": "full"}` | Every action on the connection | Default (admin, no action allowlist) |
-| `{"policy": "methods", "methods": ["GET"]}` | Only actions with those HTTP methods | Permission level is `read` or `write` |
-| `{"policy": "actions", "actions": [{"actionId": "...", "title": "...", "method": "..."}]}` | Only these specific actions | An action allowlist is configured |
+| Policy | Means | `level` |
+|--------|-------|---------|
+| `{"policy": "full"}` | Every action on the connection | `full` (Full access) |
+| `{"policy": "methods", "methods": ["GET"]}` | Only actions with those methods | `read-only`, `read-write` (GET, POST, PUT, PATCH), or `custom` |
+| `{"policy": "actions", "actions": [{"actionId": "...", "title": "...", "method": "..."}]}` | Only these specific actions | `custom`, or `none` when empty |
 
-An action allowlist wins over the permission level (and is then method-filtered by it). When the policy is `actions`, those actions are exactly what may run — `actions load <actionId>` reads their docs, no find needed.
+A connection the key does not reach is not listed. When the policy is `actions`, those actions are exactly what may run — `actions load <actionId>` reads their docs, no find needed.
 
 ```jsonc
 // one --agent list
@@ -219,14 +219,14 @@ An action allowlist wins over the permission level (and is then method-filtered
       "platform": "gmail",
       "state": "operational",
       "key": "live::gmail::default::abc123",
-      "access": { "policy": "methods", "methods": ["GET"] }
+      "access": { "policy": "methods", "methods": ["GET"], "level": "read-only" }
     }
   ],
-  "accessHint": "Permission level \"read\": only GET actions will execute."
+  "accessSource": "server"
 }
 ```
 
-`knowledgeOnly: true` appears when knowledge-only mode is on (execution disabled), and `unresolvedActionIds` lists any allowlisted action ids that could not be looked up. In human output, an `Access` column and a summary note appear only when access is actually scoped.
+`accessSource` is `"server"` when One reported the key's access and `"local"` when it could not (an older API); then `access` shows only the CLI's own settings, the human table labels the column "Access (CLI settings only)", and `accessHint` says One may allow less. `knowledgeOnly: true` appears when knowledge-only mode is on (execution disabled), and `unresolvedActionIds` lists action ids that could not be looked up.
 
 This mirrors the `access` field on the One MCP server's `list_one_integrations` tool, so both surfaces report access the same way.
 

package/dist/{chunk-6FA7KUNQ.js → chunk-MRQ47KSZ.js}

@@ -104,6 +104,20 @@ var OneApi = class {
     if (!text) return {};
     return JSON.parse(text);
   }
+  /**
+   * The calling key's own access, as One enforces it: `GET /v1/access/me`.
+   * Resolves `null` for a key with no restrictions. Throws `ApiError` when the
+   * API does not answer it (for example an older backend without the route).
+   */
+  async getOwnAccess() {
+    const body = await this.request("/access/me");
+    if (body === null) return null;
+    if (typeof body !== "object" || !("rules" in body || "methods" in body)) {
+      throw new ApiError(502, "Unexpected answer from /access/me");
+    }
+    const doc = body;
+    return { methods: doc.methods ?? null, rules: doc.rules ?? null };
+  }
   async whoami() {
     return this.request("/users/whoami");
   }
@@ -2285,7 +2299,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-SFECNAO2.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-4A5ANCTT.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/{flow-runner-SFECNAO2.js → flow-runner-4A5ANCTT.js}

@@ -12,7 +12,7 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-6FA7KUNQ.js";
+} from "./chunk-MRQ47KSZ.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-HTXZZQ6U.js";
 export {

package/dist/index.js

@@ -28,7 +28,7 @@ import {
   validateActionInput,
   walkSteps,
   writeCache
-} from "./chunk-6FA7KUNQ.js";
+} from "./chunk-MRQ47KSZ.js";
 import {
   memSqlCommand
 } from "./chunk-7FPQOAQ4.js";
@@ -2610,21 +2610,91 @@ async function resolveAllowedActions(api, actionIds) {
   );
   return resolved.filter((a) => a !== null);
 }
-function computeConnectionAccess(platform, permissions, allowedActionIds, grantedActions) {
-  if (!allowedActionIds.includes("*")) {
-    const actions2 = grantedActions.filter((a) => a.platform === platform).map(({ actionId, title, method }) => ({ actionId, title, method }));
-    return { policy: "actions", actions: actions2 };
+var UNRESTRICTED = { reachable: true, methods: null, actionIds: null };
+var UNREACHABLE = { reachable: false, methods: [], actionIds: [] };
+function serverEnvelope(doc, connectionKey) {
+  if (!doc) return UNRESTRICTED;
+  if (doc.rules === null) return { reachable: true, methods: doc.methods, actionIds: null };
+  const rule = doc.rules.find((r) => r.connectionKey === connectionKey);
+  if (!rule) return UNREACHABLE;
+  return {
+    reachable: true,
+    methods: rule.methods ?? doc.methods,
+    actionIds: rule.actionIds ?? null
+  };
+}
+function localEnvelope(permissions, actionIds, connectionKeys, connectionKey) {
+  if (!connectionKeys.includes("*") && !connectionKeys.includes(connectionKey)) return UNREACHABLE;
+  return {
+    reachable: true,
+    methods: PERMISSION_METHODS[permissions],
+    actionIds: actionIds.includes("*") ? null : actionIds
+  };
+}
+function intersectList(a, b) {
+  if (a === null) return b;
+  if (b === null) return a;
+  const upper = new Set(b.map((x) => x.toUpperCase()));
+  return a.filter((x) => upper.has(x.toUpperCase()));
+}
+function intersectEnvelopes(a, b) {
+  if (!a.reachable || !b.reachable) return UNREACHABLE;
+  return {
+    reachable: true,
+    methods: intersectList(a.methods, b.methods),
+    actionIds: a.actionIds === null ? b.actionIds : b.actionIds === null ? a.actionIds : a.actionIds.filter((id) => b.actionIds.includes(id))
+  };
+}
+function envelopeToAccess(envelope, resolved, localMethods = null) {
+  if (!envelope.reachable || envelope.methods !== null && envelope.methods.length === 0) {
+    return { access: { policy: "actions", actions: [] }, unresolved: [] };
   }
-  const methods = PERMISSION_METHODS[permissions];
-  if (methods !== null) {
-    return { policy: "methods", methods };
+  if (envelope.actionIds !== null) {
+    const actions2 = envelope.actionIds.flatMap((id) => {
+      const hit = resolved.find((a) => a.actionId === id);
+      if (!hit) return [];
+      if (localMethods && !localMethods.includes(hit.method.toUpperCase())) return [];
+      return [{ actionId: hit.actionId, title: hit.title, method: hit.method }];
+    });
+    return {
+      access: { policy: "actions", actions: actions2 },
+      unresolved: envelope.actionIds.filter((id) => !resolved.some((a) => a.actionId === id))
+    };
   }
-  return { policy: "full" };
+  if (envelope.methods !== null) {
+    return { access: { policy: "methods", methods: envelope.methods.map((m) => m.toUpperCase()) }, unresolved: [] };
+  }
+  return { access: { policy: "full" }, unresolved: [] };
 }
-function formatAccess(access, maxActions = 2) {
+var READ_WRITE = ["GET", "PATCH", "POST", "PUT"];
+function accessLevel(access) {
   switch (access.policy) {
     case "full":
       return "full";
+    case "methods": {
+      const set = [...new Set(access.methods.map((m) => m.toUpperCase()))].sort();
+      if (set.length === 0) return "none";
+      if (set.length === 1 && set[0] === "GET") return "read-only";
+      if (set.join(",") === READ_WRITE.join(",")) return "read-write";
+      return "custom";
+    }
+    case "actions":
+      return access.actions.length === 0 ? "none" : "custom";
+  }
+}
+var LEVEL_LABELS = {
+  full: "Full access",
+  "read-write": "Read & write",
+  "read-only": "Read only",
+  custom: "Custom",
+  none: "No access"
+};
+function formatAccess(access, maxActions = 2) {
+  const level = accessLevel(access);
+  if (level !== "custom") return LEVEL_LABELS[level];
+  switch (access.policy) {
+    case "full":
+      return LEVEL_LABELS.full;
     case "methods":
       return access.methods.join(", ");
     case "actions": {
@@ -2847,18 +2917,30 @@ async function connectionListCommand(options) {
   const spinner = createSpinner();
   spinner.start("Loading connections...");
   try {
-    const allConnections = await api.listConnections();
+    const [allConnections, serverAccess] = await Promise.all([
+      api.listConnections(),
+      api.getOwnAccess().then(
+        (doc) => ({ ok: true, doc }),
+        () => ({ ok: false, doc: null })
+      )
+    ]);
     const ac = getAccessControlFromAllSources();
     const permissions = ac.permissions || "admin";
     const allowedKeys = ac.connectionKeys || ["*"];
     const actionIds = ac.actionIds || ["*"];
     const knowledgeOnly = ac.knowledgeAgent || false;
-    const accessFiltered = allowedKeys.includes("*") ? allConnections : allConnections.filter((conn) => allowedKeys.includes(conn.key));
-    const resolvedActions = await resolveAllowedActions(api, actionIds);
-    const unresolvedActionIds = actionIds.includes("*") ? [] : actionIds.filter((id) => !resolvedActions.some((a) => a.actionId === id));
-    const grantedActions = resolvedActions.filter((a) => isMethodAllowed(a.method, permissions));
-    const accessFor = (platform) => computeConnectionAccess(platform, permissions, actionIds, grantedActions);
-    const hintText = accessHint(permissions, actionIds, knowledgeOnly);
+    const envelopeFor = (key) => intersectEnvelopes(serverEnvelope(serverAccess.doc, key), localEnvelope(permissions, actionIds, allowedKeys, key));
+    const accessFiltered = allConnections.filter((conn) => envelopeFor(conn.key).reachable);
+    const namedActionIds = new Set(actionIds.includes("*") ? [] : actionIds);
+    for (const rule of serverAccess.doc?.rules ?? []) for (const id of rule.actionIds ?? []) namedActionIds.add(id);
+    const resolvedActions = await resolveAllowedActions(api, [...namedActionIds]);
+    const unresolved = /* @__PURE__ */ new Set();
+    const accessFor = (conn) => {
+      const { access, unresolved: missing } = envelopeToAccess(envelopeFor(conn.key), resolvedActions, PERMISSION_METHODS[permissions]);
+      missing.forEach((id) => unresolved.add(id));
+      return access;
+    };
+    const hintText = accessHint(permissions, actionIds, knowledgeOnly, serverAccess.ok ? serverAccess.doc : void 0);
     const searchQuery = options?.search?.toLowerCase();
     const filtered = searchQuery ? accessFiltered.filter((conn) => conn.platform.toLowerCase().includes(searchQuery)) : accessFiltered;
     const limitArg = options?.limit ? parseInt(options.limit, 10) : void 0;
@@ -2875,10 +2957,11 @@ async function connectionListCommand(options) {
           key: conn.key,
           ...conn.name && { name: conn.name },
           ...conn.tags?.length && { tags: conn.tags },
-          access: accessFor(conn.platform)
+          access: withLevel(accessFor(conn))
         })),
+        accessSource: serverAccess.ok ? "server" : "local",
         ...knowledgeOnly && { knowledgeOnly: true },
-        ...unresolvedActionIds.length > 0 && { unresolvedActionIds },
+        ...unresolved.size > 0 && { unresolvedActionIds: [...unresolved] },
         ...hintText && { accessHint: hintText },
         ...limited.length < filtered.length && {
           hint: `Showing ${limited.length} of ${filtered.length} connections. Use --search <query> to filter by platform or --limit <n> to see more.`
@@ -2896,6 +2979,13 @@ async function connectionListCommand(options) {
 Try: ${pc6.cyan("one connection list")} to see all connections.`,
           "No Results"
         );
+      } else if (serverAccess.doc?.rules && allConnections.length === 0) {
+        p4.note(
+          `This key reaches no connections: it can search actions and read their docs, but runs none.
+
+Change it in the dashboard under API keys.`,
+          "No Connections"
+        );
       } else {
         p4.note(
           `No connections yet.
@@ -2913,10 +3003,9 @@ Add one with: ${pc6.cyan("one connection add gmail")}`,
       state: conn.state,
       key: conn.key,
       tags: conn.tags?.length ? conn.tags.join(", ") : "",
-      access: formatAccess(accessFor(conn.platform))
+      access: formatAccess(accessFor(conn))
     }));
     const hasTags = rows.some((r) => r.tags);
-    const hasScopedAccess = rows.some((r) => r.access !== "full");
     printTable(
       [
         { key: "status", label: "" },
@@ -2924,21 +3013,22 @@ Add one with: ${pc6.cyan("one connection add gmail")}`,
         { key: "state", label: "Status" },
         { key: "key", label: "Connection Key", color: pc6.dim },
         ...hasTags ? [{ key: "tags", label: "Tags", color: pc6.dim }] : [],
-        ...hasScopedAccess ? [{ key: "access", label: "Access", color: pc6.yellow }] : []
+        { key: "access", label: serverAccess.ok ? "Access" : "Access (CLI settings only)", color: pc6.yellow }
       ],
       rows
     );
     console.log();
-    if (hintText) {
-      const lines = [hintText];
-      if (unresolvedActionIds.length > 0) {
-        lines.push(
-          `Could not resolve ${unresolvedActionIds.length} allowlisted action id(s): ${unresolvedActionIds.join(", ")}`
-        );
+    if (hintText || unresolved.size > 0) {
+      const lines = hintText ? [hintText] : [];
+      if (unresolved.size > 0) {
+        lines.push(`Could not resolve ${unresolved.size} allowed action id(s): ${[...unresolved].join(", ")}`);
       }
-      p4.note(`${wrapText(lines.join("\n"))}
+      p4.note(
+        `${wrapText(lines.join("\n"))}
 
-Change it with: ${pc6.cyan("one config")}`, "Access");
+This key's access: dashboard \u2192 API keys. This CLI's own limits: ${pc6.cyan("one config")}`,
+        "Access"
+      );
     }
     if (displayed.length < filtered.length) {
       p4.note(
@@ -3012,21 +3102,35 @@ async function connectionDeleteCommand(connectionKey, options) {
     error(`Error: ${error2 instanceof Error ? error2.message : "Unknown error"}`);
   }
 }
-function accessHint(permissions, actionIds, knowledgeOnly) {
+function accessHint(permissions, actionIds, knowledgeOnly, server) {
   const parts = [];
+  if (server === void 0) {
+    parts.push(
+      "One did not report this key's access, so each `access` shows only this CLI's own settings; One may allow less. Check the key in the dashboard under API keys."
+    );
+  } else if (server?.rules && server.rules.length === 0) {
+    parts.push("This key reaches no connections: it can read docs and search actions, but no action will execute.");
+  } else if (server?.rules?.some((r) => r.actionIds)) {
+    parts.push(
+      "Some connections are action-scoped: their `access.actions` are the only actions you may run there \u2014 use them directly: `actions load <actionId>` reads their docs, no find needed."
+    );
+  }
   if (!actionIds.includes("*")) {
     parts.push(
-      "Action-scoped: each connection's `access.actions` are the only actions you may run \u2014 use them directly: `actions load <actionId>` reads their docs, no find needed."
+      "Action-scoped (local settings): each connection's `access.actions` are the only actions you may run \u2014 use them directly: `actions load <actionId>` reads their docs, no find needed."
     );
   } else if (permissions !== "admin") {
     const methods = PERMISSION_METHODS[permissions]?.join(", ") ?? "";
-    parts.push(`Permission level "${permissions}": only ${methods} actions will execute.`);
+    parts.push(`Permission level "${permissions}" (local settings): only ${methods} actions will execute.`);
   }
   if (knowledgeOnly) {
     parts.push("Knowledge-only mode: `actions execute` is disabled \u2014 read knowledge and write code instead.");
   }
   return parts.length > 0 ? parts.join(" ") : null;
 }
+function withLevel(access) {
+  return { ...access, level: accessLevel(access) };
+}
 function wrapText(text5, width = 72) {
   return text5.split("\n").map((paragraph) => {
     const lines = [];
@@ -11411,7 +11515,7 @@ Request specific sections:
 - Always use the **exact action ID** from a find answer \u2014 don't guess
 - Always read **knowledge** before executing any action
 - Connection keys come from \`one connection list\` \u2014 don't hardcode them
-- \`connection list\` also reports an \`access\` field per connection (\`full\` / \`methods\` / \`actions\`) \u2014 read it before planning so you don't propose an action the access config will reject
+- \`connection list\` also reports an \`access\` field per connection (\`full\` / \`methods\` / \`actions\`, plus a \`level\`: full, read-write, read-only, custom, none) \u2014 what One enforces for this key, narrowed by \`one config\`. Read it before planning so you don't propose an action that will be refused. \`accessSource: "local"\` means One did not report it, so it is unverified
 - Skills stay in lockstep with the CLI version automatically \u2014 every command checks a \`.one-cli-version\` marker in the canonical skill dir and refreshes the files if the CLI has been upgraded. Check manually with \`one config skills status\`; force a resync with \`one config skills sync\`
 - Building an app whose users connect their own tools? \`one skills add connect\` (run inside the app) installs the One Connect skill from the \`@withone/connect\` version the app uses, into \`.agents/skills/one-connect\` and \`.claude/skills/one-connect\`. \`one --agent skills list\` shows what is installed; any \`one\` command in the project refreshes it after an SDK upgrade
 `;
@@ -11427,7 +11531,7 @@ Always follow this sequence. Never execute without reading the action's document
 one --agent connection list
 \`\`\`
 
-Returns platforms, status, connection keys, tags, and an \`access\` field per connection describing what the current access config lets you run there:
+Returns platforms, status, connection keys, tags, and an \`access\` field per connection: what One enforces for this key (the consent page's choices, or the dashboard's), narrowed by \`one config\`. \`access.level\` names it as the consent page does (full, read-write, read-only, custom, none):
 
 | \`access\` | Meaning |
 |----------|---------|
@@ -11435,9 +11539,9 @@ Returns platforms, status, connection keys, tags, and an \`access\` field per co
 | \`{"policy": "methods", "methods": ["GET"]}\` | Only actions with these HTTP methods will execute |
 | \`{"policy": "actions", "actions": [{"actionId", "title", "method"}]}\` | Only these exact actions \u2014 use them directly: \`actions load <actionId>\` reads their docs, no find needed |
 
-Also present when relevant: \`knowledgeOnly: true\` (execution disabled \u2014 read the docs and write code instead), \`unresolvedActionIds\` (allowlisted ids that could not be looked up), and \`accessHint\` (a one-line summary of the restriction).
+\`accessSource\` is \`server\` when One reported it, \`local\` when it could not (then it is unverified). Also present when relevant: \`knowledgeOnly: true\` (execution disabled \u2014 read the docs and write code instead), \`unresolvedActionIds\` (allowlisted ids that could not be looked up), and \`accessHint\` (a one-line summary of the restriction).
 
-Read \`access\` before planning \u2014 it prevents proposing an action the config will reject. Change it with \`one config\`.
+Read \`access\` before planning \u2014 it prevents proposing an action that will be refused. The key's access changes in the dashboard (API keys); this CLI's own limits with \`one config\`.
 
 ### 1b. Delete a Connection
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.4.0",
+  "version": "2.5.0",
   "description": "CLI for managing One",
   "type": "module",
   "files": [

package/skills/one/SKILL.md

@@ -47,7 +47,7 @@ Always follow this sequence when the user wants to do something on a connected p
 one --agent connection list
 ```
 
-Returns connected platforms with their connection keys (needed for execution), platform names in kebab-case (needed for finding actions), and an `access` field per connection telling you what you may run there.
+Returns connected platforms with their connection keys (needed for execution), platform names in kebab-case (needed for finding actions), and an `access` field per connection telling you what you may run there. `access` is what One enforces for this key (the choices made on the consent page, or later in the dashboard), narrowed by any limits set with `one config`; `access.level` names it the way the consent page does: `full`, `read-write`, `read-only`, `custom` or `none`. When telling the user their access, use those words (Full access, Read & write, Read only, Custom, No access).
 
 **Read `access` before you plan a workflow** — it saves you from discovering a restriction as a 403 halfway through:
 
@@ -57,6 +57,8 @@ Returns connected platforms with their connection keys (needed for execution), p
 | `{"policy": "methods", "methods": ["GET"]}` | Only actions with these HTTP methods will execute — don't propose writes |
 | `{"policy": "actions", "actions": [...]}` | Only these exact actions may run. Each has `actionId`, `title`, `method` — **use them directly**: `actions load <actionId>` reads their docs, no find needed |
 
+`accessSource` is `"server"` when One reported the key's access, or `"local"` when it could not (the `accessHint` says so) — then `access` reflects only this CLI's settings and One may allow less: tell the user it is unverified rather than calling it full access.
+
 Two more fields appear only when relevant:
 - `"knowledgeOnly": true` — `actions execute` is disabled. `actions find` returns each action's whole document with how to call it from code; write integration code instead of executing.
 - `"unresolvedActionIds": [...]` — allowlisted ids that couldn't be looked up; treat them as unavailable and tell the user.