@withone/cli - npm Package Compare versions

Comparing version 1.34.0 to 1.35.0

package.json

 {
   "name": "@withone/cli",
-  "version": "1.34.0",
+  "version": "1.35.0",
   "description": "CLI for managing One",
@@ -5,0 +5,0 @@ "type": "module",

README.md

@@ -42,4 +42,11 @@ <img src="https://assets.withone.ai/banners/cli.png" alt="One CLI - Connect your agents to every API on the internet." style="border-radius: 5px;">
 
-`one init` walks you through setup: enter your [API key](https://app.withone.ai/settings/api-keys), pick your AI agents, and you're done. The MCP server gets installed automatically.
+`one init` walks you through setup: authenticate via browser or enter your [API key](https://app.withone.ai/settings/api-keys), pick your AI agents, and you're done. The MCP server gets installed automatically.
 
+Or authenticate directly:
+
+```bash
+one login              # Opens browser for authentication (global or per-directory)
+one logout             # Clear credentials (with scope picker and confirmation)
+```
+
 Requires Node.js 18+.
@@ -46,0 +53,0 @@

skills/one/SKILL.md

@@ -27,2 +27,11 @@ ---
 
+## Authentication
+
+```bash
+one login                    # Browser-based login (opens app.withone.ai)
+one logout                   # Clear local credentials
+```
+
+`one login` opens the browser for OAuth authentication and automatically creates and stores an API key. If already logged in, the user can choose to log in globally or for the current directory. `one logout` shows current session info and confirms before clearing credentials. For CI/CD or headless environments, use `one init` to paste a key manually.
+
 ## Core Workflow: search -> knowledge -> execute
@@ -29,0 +38,0 @@

New alerts

Network access

Supply chain risk

This module accesses the network.

Found 2 instances in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 6 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Network access

Supply chain risk

This module accesses the network.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Debug access

Supply chain risk

Uses debug, reflection and dynamic code execution features.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 6 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

Long strings

Supply chain risk

Contains long string literals, which may be a sign of obfuscated or packed code.

Found 1 instance in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

534960

3.52%

Lines of code

12080

3.62%

Number of lines in readme file

563

1.26%

Worsened metrics

Number of low supply chain risk alerts

85

2.41%

Number of medium supply chain risk alerts

37

2.78%

No dependency changes