feat: add apps connect/list/disconnect commands for OAuth app connections

Author: johnnyfish

cmd/onecli/apps.go

@@ -0,0 +1,115 @@
+package main
+
+import (
+	"fmt"
+
+	"github.com/onecli/onecli-cli/internal/api"
+	"github.com/onecli/onecli-cli/pkg/output"
+	"github.com/onecli/onecli-cli/pkg/validate"
+)
+
+// AppsCmd is the `onecli apps` command group.
+type AppsCmd struct {
+	List       AppsListCmd       `cmd:"" help:"List all app connections."`
+	Connect    AppsConnectCmd    `cmd:"" help:"Connect an OAuth app (e.g. Google)."`
+	Disconnect AppsDisconnectCmd `cmd:"" help:"Disconnect an app."`
+}
+
+// AppsListCmd is `onecli apps list`.
+type AppsListCmd struct {
+	Fields string `optional:"" help:"Comma-separated list of fields to include in output."`
+	Quiet  string `optional:"" name:"quiet" help:"Output only the specified field, one per line."`
+}
+
+func (c *AppsListCmd) Run(out *output.Writer) error {
+	client, err := newClient()
+	if err != nil {
+		return err
+	}
+	apps, err := client.ListApps(newContext())
+	if err != nil {
+		return err
+	}
+	if c.Quiet != "" {
+		return out.WriteQuiet(apps, c.Quiet)
+	}
+	return out.WriteFiltered(apps, c.Fields)
+}
+
+// AppsConnectCmd is `onecli apps connect`.
+type AppsConnectCmd struct {
+	Provider     string `required:"" help:"Provider name (e.g. 'google')."`
+	ClientID     string `required:"" name:"client-id" help:"OAuth client ID."`
+	ClientSecret string `required:"" name:"client-secret" help:"OAuth client secret."`
+	DryRun       bool   `optional:"" name:"dry-run" help:"Validate the request without executing it."`
+}
+
+// connectResponse wraps the API response with agent-facing guidance.
+type connectResponse struct {
+	ID        string `json:"id"`
+	Provider  string `json:"provider"`
+	Status    string `json:"status"`
+	CreatedAt string `json:"createdAt"`
+}
+
+const docsBaseURL = "https://docs.onecli.sh/guides/credential-stubs"
+
+func (c *AppsConnectCmd) Run(out *output.Writer) error {
+	input := api.ConnectAppInput{
+		Provider:     c.Provider,
+		ClientID:     c.ClientID,
+		ClientSecret: c.ClientSecret,
+	}
+
+	if c.DryRun {
+		preview := map[string]string{
+			"provider":     input.Provider,
+			"clientId":     input.ClientID,
+			"clientSecret": "***",
+		}
+		return out.WriteDryRun("Would connect app", preview)
+	}
+
+	client, err := newClient()
+	if err != nil {
+		return err
+	}
+	app, err := client.ConnectApp(newContext(), input)
+	if err != nil {
+		return err
+	}
+
+	docsURL := docsBaseURL + "/" + input.Provider + ".md"
+	fallbackURL := docsBaseURL + "/general-app.md"
+	out.SetHint("Your MCP server needs local credential stub files to start. See " + docsURL + " for examples (fallback: " + fallbackURL + " ). The OneCLI gateway handles real OAuth token exchange at request time.")
+	resp := connectResponse{
+		ID:        app.ID,
+		Provider:  app.Provider,
+		Status:    app.Status,
+		CreatedAt: app.CreatedAt,
+	}
+	return out.Write(resp)
+}
+
+// AppsDisconnectCmd is `onecli apps disconnect`.
+type AppsDisconnectCmd struct {
+	ID     string `required:"" help:"ID of the app connection to disconnect."`
+	DryRun bool   `optional:"" name:"dry-run" help:"Validate the request without executing it."`
+}
+
+func (c *AppsDisconnectCmd) Run(out *output.Writer) error {
+	if err := validate.ResourceID(c.ID); err != nil {
+		return fmt.Errorf("invalid app ID: %w", err)
+	}
+	if c.DryRun {
+		return out.WriteDryRun("Would disconnect app", map[string]string{"id": c.ID})
+	}
+	client, err := newClient()
+	if err != nil {
+		return err
+	}
+	if err := client.DisconnectApp(newContext(), c.ID); err != nil {
+		return err
+	}
+	return out.Write(map[string]string{"status": "disconnected", "id": c.ID})
+}

cmd/onecli/help.go

@@ -79,6 +79,15 @@ func (cmd *HelpCmd) Run(out *output.Writer) error {
 			{Name: "secrets delete", Description: "Delete a secret.", Args: []ArgInfo{
 				{Name: "--id", Required: true, Description: "ID of the secret to delete."},
 			}},
+			{Name: "apps list", Description: "List all app connections."},
+			{Name: "apps connect", Description: "Connect an OAuth app.", Args: []ArgInfo{
+				{Name: "--provider", Required: true, Description: "Provider name (e.g. 'google')."},
+				{Name: "--client-id", Required: true, Description: "OAuth client ID."},
+				{Name: "--client-secret", Required: true, Description: "OAuth client secret."},
+			}},
+			{Name: "apps disconnect", Description: "Disconnect an app.", Args: []ArgInfo{
+				{Name: "--id", Required: true, Description: "ID of the app connection to disconnect."},
+			}},
 			{Name: "rules list", Description: "List all policy rules."},
 			{Name: "rules create", Description: "Create a new policy rule.", Args: []ArgInfo{
 				{Name: "--name", Required: true, Description: "Display name for the rule."},

cmd/onecli/main.go

@@ -23,6 +23,7 @@ type CLI struct {
 	Help    HelpCmd    `cmd:"" help:"Show available commands."`
 	Agents  AgentsCmd  `cmd:"" help:"Manage agents."`
 	Secrets SecretsCmd `cmd:"" help:"Manage secrets."`
+	Apps    AppsCmd    `cmd:"" help:"Manage app connections."`
 	Rules   RulesCmd   `cmd:"" help:"Manage policy rules."`
 	Auth    AuthCmd    `cmd:"" help:"Manage authentication."`
 	Config  ConfigCmd  `cmd:"" help:"Manage configuration settings."`
@@ -114,6 +115,8 @@ func hintForCommand(cmd, host string) string {
 		return "Manage your secrets \u2192 " + host
 	case "agents":
 		return "Manage your agents \u2192 " + host
+	case "apps":
+		return "Manage your app connections \u2192 " + host
 	case "rules":
 		return "Manage your policy rules \u2192 " + host
 	case "auth":

internal/api/apps.go

@@ -0,0 +1,49 @@
+package api
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+)
+
+// App represents an app connection returned by the API.
+type App struct {
+	ID        string `json:"id"`
+	Provider  string `json:"provider"`
+	Status    string `json:"status"`
+	Docs      string `json:"docs,omitempty"`
+	CreatedAt string `json:"createdAt"`
+}
+
+// ConnectAppInput is the request body for connecting an app.
+type ConnectAppInput struct {
+	Provider     string `json:"provider"`
+	ClientID     string `json:"clientId"`
+	ClientSecret string `json:"clientSecret"`
+}
+
+// ListApps returns all app connections for the authenticated user.
+func (c *Client) ListApps(ctx context.Context) ([]App, error) {
+	var apps []App
+	if err := c.do(ctx, http.MethodGet, "/api/apps", nil, &apps); err != nil {
+		return nil, fmt.Errorf("listing apps: %w", err)
+	}
+	return apps, nil
+}
+
+// ConnectApp creates a new app connection.
+func (c *Client) ConnectApp(ctx context.Context, input ConnectAppInput) (*App, error) {
+	var app App
+	if err := c.do(ctx, http.MethodPost, "/api/apps", input, &app); err != nil {
+		return nil, fmt.Errorf("connecting app: %w", err)
+	}
+	return &app, nil
+}
+
+// DisconnectApp removes an app connection by ID.
+func (c *Client) DisconnectApp(ctx context.Context, id string) error {
+	if err := c.do(ctx, http.MethodDelete, "/api/apps/"+id, nil, nil); err != nil {
+		return fmt.Errorf("disconnecting app: %w", err)
+	}
+	return nil
+}