@withone/cli 2.9.1 → 2.10.0

package/README.md

@@ -50,10 +50,14 @@ one logout             # Clear credentials (with scope picker and confirmation)
 
 The browser consent page names the key and tags it with where this CLI is installed (scope, project path, machine, OS user, CLI version, chosen harnesses, and the per-install device id unless telemetry is off) so you can find and revoke it from Settings → API keys. The terminal prints exactly what will be sent before the browser opens.
 
-Requires Node.js 18+. `one sync` additionally needs Node 20+, because its
-local SQLite engine (`better-sqlite3`, an optional dependency) ships prebuilt
-binaries only for Node 20 and above. On Node 18 every other command works
-normally; `one sync` reports that the engine isn't installed.
+Requires Node.js 22.23.4+, 24.22.1+ or 26.12.1+. Older Node versions trust the
+compromised eMudhra intermediate CA certificates (October 2026), so a network
+attacker could intercept the CLI's traffic and your API key. On them the CLI
+refuses to run and prints the command that updates Node for how you installed
+it. Node 18, 20, 23 and 25 are end-of-life and never got the fix.
+
+If you can't update Node yet, `ONE_ALLOW_UNPATCHED_NODE=1` runs the CLI anyway,
+with a security warning on every run. You remain exposed while it is set.
 
 ## Quick start
 
@@ -523,6 +527,17 @@ What `one skills add connect` does:
 
 Commit `.agents/skills/one-connect` and the agent links so your team's agents share the skill. Agent mode (`--agent`) returns JSON for every subcommand.
 
+### `one connect`
+
+Create and update a [One Connect](https://www.npmjs.com/package/@withone/connect) app from `one.connect.ts`, typed by `defineConnectApp` from `@withone/connect/config` (0.19.0 or later).
+
+```bash
+one connect types     # writes one-connect-env.d.ts: tool slugs and action names autocomplete
+one connect create    # approve the app in the browser; re-run to review and apply changes
+```
+
+`one connect create` opens a setup page in your signed-in browser, where you review the app (or, on a re-run, its new version) and approve it; nothing is created or changed with your API key. A new app's client secret and connect key are made there and shown once, so they never pass through the terminal. Once you approve, the CLI writes `ONE_CLIENT_ID`, `ONE_PERMISSION_SET` and `ONE_REDIRECT_URI` to `.env.local` (or `.env`). Each tool in `ask` takes `access`: `read-only`, `read-write`, `full-access`, or `custom` with `actions`, named as `one connect types` wrote them or by id from `one actions find <platform> "<what it does>" --no-knowledge`. Options: `--config <file>`, `--env-file <file>`, `--no-open`. Install `@withone/connect` (0.19.0 or later) in the project first. A `.ts` config needs Node 22.18 or later; on older Node use `one.connect.mjs`.
+
 ### `one guide [topic]`
 
 Get the full CLI usage guide, designed for AI agents that only have the binary (no MCP, no IDE skills).

package/bin/cli.js

@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 
-import { program } from '../dist/index.js';
+import { requirePatchedNode } from '../dist/node-check.js';
+
+// eMudhra CA compromise: refuse to run before any connection opens on a Node
+// that still trusts the leaked intermediates (see src/node-check.ts).
+requirePatchedNode();
+
+const { program } = await import('../dist/index.js');
 
 program.parse();

package/dist/{chunk-UP2L4XJH.js → chunk-5CPQHXTO.js}

@@ -1120,6 +1120,22 @@ var OneApi = class {
       };
     }
   }
+  /** Every action on a platform, page by page, following the server's `pages`. */
+  async listAllAvailableActions(platform) {
+    const all = [];
+    let page = 1;
+    let totalPages = 1;
+    do {
+      const response = await this.requestFull({
+        path: `/available-actions/${encodeURIComponent(platform)}`,
+        queryParams: { page: String(page), limit: "100" }
+      });
+      all.push(...response.rows || []);
+      totalPages = response.pages || 1;
+      page++;
+    } while (page <= totalPages);
+    return all;
+  }
   // Webhook Relay methods
   async createRelayEndpoint(body) {
     return this.requestFull({ path: "/webhooks/relay", method: "POST", body });
@@ -2961,7 +2977,7 @@ async function executeSubflowStep(step, context, api, permissions, allowedAction
   if (flowStack.includes(resolvedKey)) {
     throw new Error(`Circular flow detected: ${[...flowStack, resolvedKey].join(" \u2192 ")}`);
   }
-  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-K73VDSS3.js");
+  const { loadFlowWithMeta: loadFlowWithMeta2 } = await import("./flow-runner-P23IZDWM.js");
   const { flow: subFlow, rootDir: subRootDir } = loadFlowWithMeta2(resolvedKey);
   const subContext = await executeFlow(
     subFlow,

package/dist/chunk-FYTWXGPJ.js

@@ -0,0 +1,79 @@
+// src/node-check.ts
+var FIXED_IN = {
+  22: [23, 4],
+  24: [22, 1],
+  26: [12, 1]
+};
+var FIRST_LINE_WITH_FIX = 27;
+var RECOMMENDED_LINE = 24;
+var REQUIRED_NODE = "22.23.4+, 24.22.1+ or 26.12.1+";
+var REQUIRED_NODE_RANGE = "^22.23.4 || ^24.22.1 || >=26.12.1";
+var ALLOW_UNPATCHED_ENV = "ONE_ALLOW_UNPATCHED_NODE";
+function parseVersion(version) {
+  const [major, minor, patch] = version.split(".").map((part) => Number.parseInt(part, 10));
+  return [major, minor, patch ?? 0];
+}
+function nodeHasTlsFix(version = process.versions.node) {
+  const [major, minor, patch] = parseVersion(version);
+  if (!Number.isFinite(major)) return false;
+  if (major >= FIRST_LINE_WITH_FIX) return true;
+  const fixed = FIXED_IN[major];
+  if (!fixed) return false;
+  const [fixedMinor, fixedPatch] = fixed;
+  return minor > fixedMinor || minor === fixedMinor && patch >= fixedPatch;
+}
+function upgradeCommand(version = process.versions.node, execPath = process.execPath) {
+  const [major] = parseVersion(version);
+  const line = FIXED_IN[major] ? major : RECOMMENDED_LINE;
+  const path = execPath.replace(/\\/g, "/");
+  if (/\/\.nvm\/versions\/node\//.test(path)) return `nvm install ${line} && nvm alias default ${line}`;
+  if (/\/AppData\/(Roaming|Local)\/nvm\//i.test(path)) return `nvm install ${line} && nvm use ${line}`;
+  if (/\/\.?volta\//i.test(path)) return `volta install node@${line}`;
+  if (/fnm/i.test(path)) return `fnm install ${line} && fnm default ${line}`;
+  const brew = path.match(/\/Cellar\/(node(?:@\d+)?)\//);
+  if (brew) {
+    const formula = brew[1] === "node" || FIXED_IN[major] ? brew[1] : `node@${line}`;
+    return formula === brew[1] ? `brew upgrade ${formula}` : `brew install ${formula}`;
+  }
+  return `download Node.js ${line} from https://nodejs.org`;
+}
+function unpatchedNodeMessage(version = process.versions.node) {
+  return `Node.js v${version} trusts the compromised eMudhra certificates, so a network attacker could intercept One's traffic and your API key. The One CLI requires Node.js ${REQUIRED_NODE} (Node 18, 20, 23 and 25 never got the fix).`;
+}
+function requirePatchedNode() {
+  if (nodeHasTlsFix()) return;
+  const message = unpatchedNodeMessage();
+  const upgrade = upgradeCommand();
+  const agent = process.argv.includes("--agent") || process.env.ONE_AGENT === "1";
+  if (process.env[ALLOW_UNPATCHED_ENV] === "1") {
+    if (!agent) process.stderr.write(`Warning: ${message} Running anyway because ${ALLOW_UNPATCHED_ENV}=1.
+`);
+    return;
+  }
+  if (agent) {
+    const error = {
+      error: `${message} Ask the user to update Node.js: ${upgrade}`,
+      code: "NODE_UPGRADE_REQUIRED",
+      currentNode: process.versions.node,
+      requiredNode: REQUIRED_NODE_RANGE,
+      upgrade
+    };
+    process.stdout.write(`${JSON.stringify(error)}
+`);
+  } else {
+    process.stderr.write(`Error: ${message}
+To update: ${upgrade}
+`);
+  }
+  process.exit(1);
+}
+
+export {
+  REQUIRED_NODE,
+  REQUIRED_NODE_RANGE,
+  ALLOW_UNPATCHED_ENV,
+  nodeHasTlsFix,
+  upgradeCommand,
+  unpatchedNodeMessage,
+  requirePatchedNode
+};

package/dist/{flow-runner-K73VDSS3.js → flow-runner-P23IZDWM.js}

@@ -12,7 +12,7 @@ import {
   stripStepsAlias,
   summarizeFlowInputs,
   walkSteps
-} from "./chunk-UP2L4XJH.js";
+} from "./chunk-5CPQHXTO.js";
 import "./chunk-44CV5IMX.js";
 import "./chunk-Q6PWTATS.js";
 import "./chunk-HTXZZQ6U.js";

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { Command } from 'commander';
+export { nodeHasTlsFix } from './node-check.js';
 
 declare const program: Command;