{
  "markdown": "# OneCLI Agent Plugins\n\nConnect AI coding agents to external APIs without managing credentials. The OneCLI gateway injects stored credentials into outbound requests automatically, so you don't need API keys in your environment or OAuth flows in your terminal.\n\nThis repo ships the OneCLI gateway plugin for two agent platforms from a single shared codebase:\n\n| Plugin | Platform | Path |\n|--------|----------|------|\n| **onecli** for Claude Code | [Claude Code](https://claude.com/claude-code) | [`plugins/claude/`](plugins/claude/) |\n| **onecli** for Codex | [OpenAI Codex](https://developers.openai.com/codex) | [`plugins/codex/`](plugins/codex/) |\n\n**Supported services**: GitHub, Gmail, Google Calendar, Google Drive, Google Docs, Google Sheets, Jira, Confluence, AWS, Datadog, Notion, Cloudflare, Todoist, Outlook, Microsoft Word, YouTube, and more.\n\n## How it works\n\nAll HTTPS traffic from the agent routes through the OneCLI gateway (`HTTPS_PROXY`), which intercepts requests and injects the right credentials (OAuth tokens, API keys, AWS SigV4 signatures). If a service isn't connected yet, the gateway returns a `connect_url` the agent shows you. Policy rules (block, rate limit, manual approval) are enforced at the gateway on every request.\n\nThe two plugins share the same runtime but activate differently, matching what each platform's hooks can do.\n\nOn Claude Code, the `SessionStart` hook fetches the gateway config once, writes live exports to `~/.onecli/env.sh`, and wires `BASH_ENV` so every Bash command picks them up. A `SessionEnd` hook cleans up.\n\nOn Codex, hooks run as child processes and cannot mutate the session environment, and there is no `SessionEnd` event. The `SessionStart` hook therefore writes `~/.onecli/env.sh` as a **credential-free loader**; a conservative `PreToolUse` hook auto-sources it for outbound Bash commands (such as `curl`, `gh`, `git push`, `npm install`), fetching fresh gateway exports per command via `bin/onecli-codex-env.mjs`. Cleanup is an explicit skill (`onecli-cleanup`), deliberately not wired to the turn-scoped `Stop` event.\n\n## Install on Claude Code\n\nFrom the Claude Code Directory: **Customize → Directory → Plugins**, search **OneCLI**, click **Install**. Or from the marketplace in this repo:\n\n```\n/plugin marketplace add onecli/onecli-plugin\n/plugin install onecli@onecli\n```\n\nThen run `/onecli-setup` once and start a new session. See [`plugins/claude/README.md`](plugins/claude/README.md).\n\n## Install on Codex\n\n```bash\ncodex plugin marketplace add https://github.com/onecli/onecli-plugin.git\ncodex plugin add onecli@onecli\n```\n\nStart a new thread, then invoke the `onecli-setup` skill (`@onecli:onecli-setup`). See [`plugins/codex/README.md`](plugins/codex/README.md).\n\n## Repo layout\n\n```\nsrc/                      TypeScript sources (single source of truth)\n  shared/runtime.mts      gateway config, key resolution, CA bundle, quoting, probing\n  claude/                 Claude Code hooks\n  codex/                  Codex hooks + env helper\nplugins/\n  claude/                 self-contained Claude Code plugin (built hooks committed)\n  codex/                  self-contained Codex plugin (built hooks committed)\n.claude-plugin/marketplace.json    Claude Code marketplace → ./plugins/claude\n.claude-plugin/plugin.json         root compatibility shim (see below)\nhooks/hooks.json                   hooks for the root shim\n.agents/plugins/marketplace.json   Codex marketplace → ./plugins/codex\ntests/test_workflows.py   end-to-end tests for both plugins (fake gateway + API)\n```\n\n**Root compatibility shim**: the Anthropic community marketplace (`claude-community`) entry for `onecli` uses a `url` source pinned to a commit of this repo, treating the **repo root** as the plugin. The root `.claude-plugin/plugin.json` therefore remains a valid manifest that points `commands`, `agents`, `skills`, and `hooks` into `./plugins/claude/`, so root installs keep working and Anthropic's CI can continue auto-bumping the SHA pin safely. The shim's `version` must always match `plugins/claude/.claude-plugin/plugin.json` (enforced by tests). It can be removed once the community entry migrates to a `git-subdir` source pointing at `plugins/claude`.\n\nBoth platforms copy only the plugin directory into their install cache, so each `plugins/*` directory must stay self-contained: `src/shared` is bundled into every built hook by tsup. **Edit `src/`, never `plugins/*/hooks` or `plugins/*/bin` directly**, then rebuild.\n\n## Development\n\n```bash\nnpm install\nnpm run typecheck   # tsc over src/\nnpm run build       # tsup: src/ → plugins/claude/hooks, plugins/codex/{hooks,bin}\nnpm run test        # python3 tests/test_workflows.py\n```\n\nBuilt hook files are committed (plugins install straight from git). After changing `src/`, run `npm run build` and commit the outputs together with the sources.\n\n## Requirements\n\n- A [OneCLI](https://onecli.sh) account\n- At least one connected service in the OneCLI dashboard\n\n## License\n\nApache-2.0\n",
  "bytes": 4992,
  "sha": "ffd27f49b1b1079ec3918459e6d5e8abdcf8959ffff231e46baa440e4d8f6ff8",
  "repo_slug": "onecli/onecli-plugin",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_onecli_onecli_plugin_onecli_19ac91fa/readme"
}