The Problem

AI agents need a single, authenticated gateway to the dozens of SaaS APIs they must call (OAuth, key management, request formats). Without a unified CLI, each integration requires bespoke code, exposing secrets and increasing maintenance overhead.

What This Does

Onecli ships a Node‑based command‑line interface that stores platform credentials in a local “One” account and exposes them through a consistent set of commands. The core logic lives in src/ (95 TypeScript files) and is invoked via the executable bin/cli.js (the npm‑published entry point).

Key modules:

  • src/lib/api.ts – builds HTTP requests, handles retries, and is imported by 21 other files (hub).
  • src/lib/config.ts – reads/writes the user’s config directory and is used by 18 callers.
  • src/lib/output.ts – central spinner and logging utilities, referenced by 26 files.

Commands (e.g. one add, one actions search) are thin wrappers under src/commands/, each delegating to the library layer.

How It Is Wired

Execution starts at bin/cli.js, which loads src/index.ts. That file wires the commander CLI and routes sub‑commands to the appropriate handler in src/commands/*.ts.

A typical flow (e.g. one actions execute …) follows:

  1. src/commands/actions.ts → calls src/lib/api.ts → requestFull (the only function that performs an outbound network call).
  2. The request function reads the stored API key via src/lib/config.ts (readConfig → filesystem).
  3. Response handling may trigger src/lib/output.ts to show a spinner (createSpinner).

The most‑connected hub is src/lib/output.ts (28 inbound imports, instability 0). Changing its public API will ripple through many commands.

Database interaction occurs in the memory plugin stack. The entry src/lib/memory/plugins/embedded-postgres/index.ts defines query, transaction, and file‑based DB init (init → ensure → PgliteBackend.open). These functions are called from 16 other files and perform both file I/O and SQLite writes.

The internal call graph shows a handful of high‑impact functions: isAgentMode (82 callers), parse (39 callers), and note (34 callers). They sit in src/lib/output.ts and src/lib/config.ts, meaning any change there risks breaking a large portion of the CLI.

How To Use It

# Clone the repo
git clone https://github.com/moses-y/Onecli
cd Onecli

# Install dependencies
npm ci

# Build (tsup config) – produces a bundled CLI
npx tsup

# Run the CLI (the package publishes a binary that forwards to src/index.ts)
node bin/cli.js init   # walks through auth, creates ~/.one config
# Or use the published package directly
npx @withone/cli@latest init

Configuration lives under the user’s home directory (~/.one/), managed by src/lib/config.ts. No environment variables are required beyond the standard Node 18 runtime.

Real‑World Use

A SaaS startup wants its internal LLM to automate onboarding emails. After one init and one add gmail, the team defines a flow in one flow create welcome … (JSON definition stored in the repo). Running one flow execute welcome -i email=jane@ex triggers the CLI to:

  1. Resolve the Gmail connection key from the local config.
  2. Call the Gmail API via src/lib/api.ts.
  3. Log progress through src/lib/output.ts.

All side‑effects (API call, file logs) are confined to the modules identified above, making the flow easy to audit.

Code Health & Issues

  • HIGH – License missing – no LICENSE file; default “all rights reserved” blocks reuse.
  • HIGH – CI does not run tests – .github/workflows/publish.yml lacks a test step despite 12 test files.
  • HIGH – eval usage – src/lib/memory/plugins/pglite/index.ts executes a computed string via exec().
  • MEDIUM – Dependabot not configured – no automated dependency updates.
  • MEDIUM – No vulnerability scan in CI – pull‑request safety missing.
  • MEDIUM – Checkout persists token – .github/workflows/publish.yml should set persist-credentials: false.
  • LOW – No job timeout – workflow could hang for up to six hours.
  • LOW – Missing repo conventions – no .editorconfig, .gitattributes, or formatter config.

These findings are derived from the static analysis output and should be addressed before production deployment.

The Bottom Line

Onecli provides a functional, TypeScript‑based CLI that consolidates credential management and API execution behind a small, well‑structured command set. The codebase is reasonably modular, but a few high‑impact hubs (src/lib/output.ts, src/lib/api.ts) and the presence of unsafe eval and missing CI safeguards mean it needs targeted refactoring and policy fixes before being considered production‑ready. Engineers comfortable with Node and SQLite can adopt it quickly, provided they remediate the highlighted health issues.