@joe-broadhead/opencode-granola 0.0.0 → 0.0.2

package/dist/index.js

@@ -1,12 +1,13 @@
 // src/index.ts
 import { Plugin } from "@opencode/plugin";
 
-// src/meta.ts
-import { readFileSync } from "node:fs";
+// src/host/tools-rpc.ts
+import { randomUUID } from "node:crypto";
+import { Rpc as Rpc2 } from "@opencode/plugin/rpc";
 
 // src/errors.ts
 import { Error as ToolError } from "@opencode/plugin/promise/tool";
-var SIGN_IN_STEPS = "Run /connect and choose Granola, or run opencode mcp auth granola in a terminal.";
+var SIGN_IN_STEPS = "Run /connect and choose Granola, then press o or Enter to open the sign-in page (in a terminal, opencode mcp auth granola opens it automatically).";
 function describe(problem) {
   return `${problem.code}: ${problem.message} Next step: ${problem.next}`;
 }
@@ -28,6 +29,7 @@ function shortReason(text3) {
   if (!reason) return "no reason given";
   return reason.length > 160 ? `${reason.slice(0, 157)}...` : reason;
 }
+var sentence = (reason) => /[.?!]$/.test(reason) ? reason : `${reason}.`;
 function connectionProblem(state, error) {
   switch (state) {
     case "connected":
@@ -36,7 +38,7 @@ function connectionProblem(state, error) {
       return {
         code: "NOT_REGISTERED",
         message: "The Granola connection isn't registered yet.",
-        next: "Retry in a few seconds; if it persists, check that plugins in your OpenCode config lists the Granola plugin and that no mcp.servers.granola entry points elsewhere."
+        next: "Retry in a few seconds; if it persists, check that no organisation policy (mcp.use) or other plugin removes the granola server, then restart OpenCode."
       };
     case "pending":
       return { code: "CONNECTING", message: "Granola is still connecting.", next: "Retry in a few seconds." };
@@ -45,14 +47,14 @@ function connectionProblem(state, error) {
     case "failed":
       return {
         code: "CONNECTION_FAILED",
-        message: `Granola connection failed: ${shortReason(error)}.`,
+        message: `Granola connection failed: ${sentence(shortReason(error))}`,
         next: "Reconnect Granola from /mcps, and if it keeps failing, run /connect and choose Granola to sign in again."
       };
     case "disabled":
       return {
         code: "DISABLED",
-        message: "Granola is disabled in your OpenCode config.",
-        next: "Remove disabled: true from mcp.servers.granola in your OpenCode config."
+        message: "Granola is disabled in OpenCode.",
+        next: 'Enable granola in /mcps, or remove "disabled": true from mcp.servers.granola in your OpenCode config.'
       };
   }
 }
@@ -75,11 +77,11 @@ function invalidOption(key, problem) {
     next: "Fix the Granola plugin options in your OpenCode config, then reload OpenCode."
   };
 }
-function hostUntested(tested, found) {
+function hostUntested(range, found) {
   return {
     code: "HOST_UNTESTED",
-    message: `The Granola plugin is tested with OpenCode ${tested}, found ${found}.`,
-    next: "Use a tested OpenCode version, or set the plugin option allowUntestedHost to true to run anyway."
+    message: `The Granola plugin supports OpenCode ${range}, found ${found || "no version"}.`,
+    next: `Use OpenCode ${range}, or set the plugin option allowUntestedHost to true to run anyway.`
   };
 }
 function skillsInvalid(path3) {
@@ -93,17 +95,6 @@ function packageInvalid(problem) {
   return { code: "PACKAGE_INVALID", message: `The Granola plugin's package.json ${problem}.`, next: "Reinstall the plugin." };
 }
 
-// src/meta.ts
-var PLUGIN_ID = "granola.meetings";
-function readPackageInfo(url = new URL("../package.json", import.meta.url)) {
-  const raw = JSON.parse(readFileSync(url, "utf8"));
-  const record3 = (value) => typeof value === "object" && value !== null;
-  if (!record3(raw) || typeof raw.version !== "string" || !record3(raw.opencode) || typeof raw.opencode.host !== "string") {
-    throw new GranolaError(packageInvalid("needs a version and an opencode.host range"));
-  }
-  return { version: raw.version, testedHost: raw.opencode.host };
-}
-
 // src/known-tools.ts
 var SERVER = "granola";
 var READ_TOOLS = [
@@ -143,6 +134,18 @@ function classify(id) {
   return "unknown";
 }
 
+// src/meta.ts
+import { readFileSync } from "node:fs";
+var PLUGIN_ID = "granola.meetings";
+function readPackageInfo(url = new URL("../package.json", import.meta.url)) {
+  const raw = JSON.parse(readFileSync(url, "utf8"));
+  const record4 = (value) => typeof value === "object" && value !== null;
+  if (!record4(raw) || typeof raw.version !== "string" || !record4(raw.opencode) || typeof raw.opencode.host !== "string") {
+    throw new GranolaError(packageInvalid("needs a version and an opencode.host range"));
+  }
+  return { version: raw.version, hostRange: raw.opencode.host };
+}
+
 // src/permissions.ts
 var DEFAULT_RULES = [
   { action: "granola_*", resource: "*", effect: "ask" },
@@ -167,15 +170,12 @@ function matches(input, pattern) {
   const source = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${source}$`, "s").test(input);
 }
-function winner(action, rules) {
-  return rules.findLast((rule) => matches(action, rule.action) && matches("*", rule.resource));
+function evaluate(rules, action) {
+  return rules.findLast((rule) => matches(action, rule.action) && matches("*", rule.resource))?.effect ?? "ask";
 }
-var SIDE_EFFECTS = [...WRITE_TOOLS.map(toolID), toolID("unknown_tool")];
+var UNKNOWN_TOOL = toolID("unknown_tool");
 function unguardedAgents(agents) {
-  return agents.filter((agent) => !hasDefaults(agent.permissions)).filter((agent) => SIDE_EFFECTS.some((action) => {
-    const rule = winner(action, agent.permissions);
-    return rule?.effect === "allow" && !rule.action.startsWith("granola");
-  })).map((agent) => agent.id);
+  return agents.filter((agent) => agent.permissions.some(isBaseAllow) && !hasDefaults(agent.permissions) && evaluate(agent.permissions, UNKNOWN_TOOL) === "allow").map((agent) => agent.id);
 }
 async function registerPermissions(ctx) {
   await ctx.agent.transform((editor) => {
@@ -185,18 +185,34 @@ async function registerPermissions(ctx) {
 
 // src/rpc/contract.ts
 import { Rpc } from "@opencode/plugin/rpc";
+var STATES = ["connected", "sign_in_required", "connecting", "disabled", "failed", "not_configured", "conflict"];
+var STATE_OF = {
+  connected: "connected",
+  pending: "connecting",
+  needs_auth: "sign_in_required",
+  failed: "failed",
+  disabled: "disabled",
+  absent: "not_configured"
+};
 var STATUS_SCHEMA = {
   type: "object",
   additionalProperties: false,
-  required: ["state", "tools", "unguardedAgents", "exportDirectory", "pluginVersion", "hostVersion", "next"],
+  required: ["version", "host", "state", "tools", "unguardedAgents", "exportDirectory", "nextStep"],
   properties: {
-    state: { type: "string", enum: ["connected", "pending", "disabled", "failed", "needs_auth", "absent"] },
+    version: { type: "string" },
+    host: {
+      type: "object",
+      additionalProperties: false,
+      required: ["version", "range", "tested"],
+      properties: { version: { type: ["string", "null"] }, range: { type: "string" }, tested: { type: "boolean" } }
+    },
+    state: { type: "string", enum: STATES },
     title: { type: "string" },
     problem: {
       type: "object",
       additionalProperties: false,
-      required: ["code", "message", "next"],
-      properties: { code: { type: "string" }, message: { type: "string" }, next: { type: "string" } }
+      required: ["code", "message"],
+      properties: { code: { type: "string" }, message: { type: "string" } }
     },
     conflict: { type: "string" },
     tools: {
@@ -226,31 +242,43 @@ var STATUS_SCHEMA = {
       }
     },
     exportDirectory: { type: "string" },
-    pluginVersion: { type: "string" },
-    hostVersion: { type: "string" },
     hostWarning: { type: "string" },
-    next: { type: "string" }
+    nextStep: { type: "string" }
   }
 };
+var STATUS_ERROR_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["code", "next"],
+  properties: { code: { type: "string" }, next: { type: "string" } }
+};
 var STATE_LABELS = {
   connected: "connected",
-  pending: "connecting",
-  needs_auth: "sign-in required",
+  connecting: "connecting",
+  sign_in_required: "sign-in required",
   failed: "failed",
   disabled: "disabled",
-  absent: "not configured"
+  not_configured: "not configured",
+  conflict: "conflict"
 };
 var TONES = {
   connected: "ok",
-  pending: "info",
-  needs_auth: "warning",
+  connecting: "info",
+  sign_in_required: "warning",
   failed: "error",
   disabled: "info",
-  absent: "warning"
+  not_configured: "warning",
+  conflict: "warning"
 };
+function hostRow(status) {
+  const { version, range, tested } = status.host;
+  const found = version ?? "unknown";
+  if (status.hostWarning) return { label: "OpenCode", text: `${found} (host untested: ${status.hostWarning}), plugin ${status.version}`, tone: "warning" };
+  return { label: "OpenCode", text: `${found} (${tested ? "tested" : "untested"}; supported range ${range}), plugin ${status.version}`, ...tested ? {} : { tone: "info" } };
+}
 function statusRows(status) {
   const connected = status.state === "connected";
-  const connection = status.conflict ? `conflict: ${status.conflict}` : `${STATE_LABELS[status.state]}${status.title ? ` (${status.title})` : ""}${status.problem ? `: ${status.problem.message} (${status.problem.code})` : ""}`;
+  const connection2 = status.state === "conflict" && status.conflict ? `conflict: ${status.conflict}` : `${STATE_LABELS[status.state]}${status.title ? ` (${status.title})` : ""}${status.problem ? `: ${status.problem.message} (${status.problem.code})` : ""}`;
   const tools = [`${status.tools.visible} available`];
   if (status.tools.hidden) tools.push(`${status.tools.hidden} hidden`);
   if (status.tools.unknown) {
@@ -259,18 +287,18 @@ function statusRows(status) {
   }
   const agents = status.unguardedAgents;
   return [
-    { label: "Connection", text: connection, tone: status.conflict ? "warning" : TONES[status.state] },
+    { label: "Connection", text: connection2, tone: TONES[status.state] },
     { label: "Account", text: !connected ? "unknown until Granola connects" : status.workspace ? `workspace ${status.workspace}` : "workspace unknown until the agent reads your Granola account" },
     { label: "Access", text: "reads run without asking; changes, new tools and exports ask first" },
     { label: "Export folder", text: status.exportDirectory },
     { label: "Tools", text: connected ? tools.join(", ") : "none until Granola connects" },
-    ...agents.length ? [{
+    agents.length ? {
       label: "Agents without default rules",
-      text: `${agents.join(", ")}: Granola writes run there without asking`,
+      text: `${agents.join(", ")}: Granola changes and new tools may run there without asking`,
       tone: "warning",
       block: permissionsSnippet(agents, status.permissionsBlock ?? [])
-    }] : [],
-    status.hostWarning ? { label: "OpenCode", text: `${status.hostVersion} (host untested: ${status.hostWarning}), plugin ${status.pluginVersion}`, tone: "warning" } : { label: "OpenCode", text: `${status.hostVersion} (tested), plugin ${status.pluginVersion}` }
+    } : { label: "Agents without default rules", text: "none" },
+    hostRow(status)
   ];
 }
 function permissionsSnippet(agents, block2) {
@@ -292,34 +320,41 @@ var Granola = Rpc.define({
   methods: {
     status: {
       input: { type: "object", properties: {}, additionalProperties: false },
-      output: STATUS_SCHEMA
+      output: STATUS_SCHEMA,
+      errors: { unavailable: STATUS_ERROR_SCHEMA }
     }
   },
   events: {}
 });
 
+// src/hosts.ts
+var TESTED_HOSTS = ["2.2.3", "2.2.4", "2.2.5"];
+
 // src/status.ts
 var LISTED_UNKNOWN = 20;
 var SAFE_NAME = /^[a-z][a-z0-9_]{0,63}$/;
 var CONFLICT_NEXT = "Remove mcp.servers.granola from your OpenCode config to use Granola's official server.";
 var NOTHING_TO_DO = "Nothing to do.";
+var UNTESTED_HOST_NEXT = `If Granola misbehaves, use OpenCode ${TESTED_HOSTS.slice(0, -1).join(", ")} or ${TESTED_HOSTS.at(-1)}.`;
 function agentFix(agents) {
   const where = agents.map((agent) => `agents.${agent}.permissions`).join(", ");
   return `Put the Granola block first in that agent's own permissions (${where}), followed by your top-level rules for granola_ actions.`;
 }
 function buildStatus(inputs) {
   const server = inputs.servers.find((entry) => entry.name === SERVER);
-  const state = server?.status.status ?? "absent";
-  const problem = connectionProblem(state, server?.status.error);
+  const connection2 = server?.status.status ?? "absent";
+  const problem = inputs.conflict ? void 0 : connectionProblem(connection2, server?.status.error);
   const classes = inputs.tools.map((tool) => ({ id: tool.id, kind: classify(tool.id) }));
   const unknown = classes.filter((tool) => tool.kind === "unknown").map((tool) => tool.id.slice(SERVER.length + 1));
-  const visible = classes.filter((tool) => tool.kind === "read" || tool.kind === "write").length;
+  const visible = classes.filter((tool) => tool.kind === "read" || tool.kind === "write" || tool.kind === "unknown").length;
   const unguarded = unguardedAgents(inputs.agents);
-  const next = (inputs.conflict ? CONFLICT_NEXT : void 0) ?? problem?.next ?? (unguarded.length ? agentFix(unguarded) : void 0) ?? NOTHING_TO_DO;
+  const nextStep = (inputs.conflict ? CONFLICT_NEXT : void 0) ?? problem?.next ?? (unguarded.length ? agentFix(unguarded) : void 0) ?? (inputs.host.warning ? UNTESTED_HOST_NEXT : void 0) ?? NOTHING_TO_DO;
   return {
-    state,
-    ...state === "connected" && server?.title ? { title: server.title } : {},
-    ...problem ? { problem } : {},
+    version: inputs.version,
+    host: { version: inputs.host.version || null, range: inputs.host.range, tested: inputs.host.tested },
+    state: inputs.conflict ? "conflict" : STATE_OF[connection2],
+    ...connection2 === "connected" && !inputs.conflict && server?.title ? { title: server.title } : {},
+    ...problem ? { problem: { code: problem.code, message: problem.message } } : {},
     ...inputs.conflict ? { conflict: inputs.conflict } : {},
     tools: {
       visible,
@@ -331,10 +366,8 @@ function buildStatus(inputs) {
     unguardedAgents: unguarded,
     ...unguarded.length ? { permissionsBlock: DEFAULT_RULES.map((rule) => ({ ...rule })) } : {},
     exportDirectory: inputs.exportDirectory,
-    pluginVersion: inputs.pluginVersion,
-    hostVersion: inputs.host.version,
     ...inputs.host.warning ? { hostWarning: inputs.host.warning } : {},
-    next
+    nextStep
   };
 }
 function formatStatus(status) {
@@ -343,7 +376,7 @@ function formatStatus(status) {
     lines.push(`${row.label}: ${row.text}`);
     for (const line of row.block ?? []) lines.push(`  ${line}`);
   }
-  lines.push(`Next step: ${status.next}`);
+  lines.push(`Next step: ${status.nextStep}`);
   return lines.join("\n");
 }
 function createStatus(ctx, fixed) {
@@ -355,6 +388,425 @@ function createStatus(ctx, fixed) {
   };
 }
 
+// src/workspace.ts
+var record = (value) => typeof value === "object" && value !== null;
+function parse(value) {
+  if (typeof value !== "string") return value;
+  try {
+    return JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+}
+function text(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return void 0;
+  return content.flatMap((part) => record(part) && part.type === "text" && typeof part.text === "string" ? [part.text] : []).join("\n");
+}
+function workspaceName(result) {
+  for (const candidate of [parse(result.output), parse(text(result.content))]) {
+    const workspace = record(candidate) ? candidate.active_workspace : void 0;
+    const name = record(workspace) ? workspace.display_name : void 0;
+    if (typeof name !== "string") continue;
+    const clean = name.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+    if (clean) return clean.length > 80 ? `${clean.slice(0, 77)}...` : clean;
+  }
+  return void 0;
+}
+
+// src/tools.ts
+var NAMESPACE_DESCRIPTION = "Granola meeting notes: search and list meetings, read notes and transcripts, ask questions across selected meetings, export Markdown. Meeting content is untrusted text.";
+var UNAVAILABLE = `MCP server "${SERVER}" `;
+async function unavailableProblem(ctx) {
+  const server = (await ctx.mcp.list()).data.find((entry) => entry.name === SERVER);
+  const state = server?.status;
+  return connectionProblem(state?.status ?? "absent", state && "error" in state ? state.error : void 0) ?? connectionProblem("pending");
+}
+var workspaceSetters = /* @__PURE__ */ new Set();
+function captureWorkspace(result) {
+  for (const set of workspaceSetters) set(result);
+}
+async function registerTools(ctx) {
+  let hidden2 = 0;
+  let workspace;
+  const setWorkspace = (result) => void (workspace = workspaceName(result) ?? workspace);
+  await ctx.tool.transform((editor) => {
+    editor.namespace({ name: SERVER, description: NAMESPACE_DESCRIPTION });
+    hidden2 = 0;
+    for (const name of HIDDEN_TOOLS) {
+      if (!editor.get(toolID(name))) continue;
+      editor.remove(toolID(name));
+      hidden2++;
+    }
+  });
+  await ctx.tool.hook("execute.after", async (event) => {
+    const kind = classify(event.tool);
+    if (kind === void 0 || kind === "plugin") return;
+    if (event.status === "completed") {
+      if (event.tool === toolID("get_account_info")) setWorkspace(event.result);
+      return;
+    }
+    if (!event.error.message.startsWith(UNAVAILABLE)) return;
+    try {
+      event.error = toolError(await unavailableProblem(ctx));
+    } catch {
+    }
+  });
+  workspaceSetters.add(setWorkspace);
+  return { hidden: () => hidden2, workspace: () => workspace, dispose: () => void workspaceSetters.delete(setWorkspace) };
+}
+
+// src/host/tools-rpc.ts
+var PLUGIN_ID2 = PLUGIN_ID;
+var KNOWN_READS = READ_TOOLS;
+function shapeResult(method, result) {
+  if (method === "get_account_info") captureWorkspace({ output: result.output, content: result.text });
+  return result;
+}
+var connectionNext = (state) => connectionProblem(state)?.next ?? "";
+var NEXT_STEPS = {
+  SESSION_UNKNOWN: `Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.`,
+  SESSION_AGENT_REQUIRED: `Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.`,
+  PERMISSION_DENIED: "Add an allow rule for the tool to the session's agent or to the session, or use a session whose agent allows it.",
+  SERVER_CONFLICT: CONFLICT_NEXT,
+  AUTH_REQUIRED: connectionNext("needs_auth"),
+  CONNECTING: connectionNext("pending"),
+  CONNECTION_FAILED: connectionNext("failed"),
+  DISABLED: connectionNext("disabled"),
+  NOT_REGISTERED: connectionNext("absent"),
+  TOOL_UNAVAILABLE: toolUnavailable("the tool").next,
+  UPSTREAM_ERROR: "Check the input against the method's schema from describe, and run /granola-status if it keeps failing.",
+  CANCELLED: "Call the method again if you still need the result."
+};
+function pluginError(_error) {
+  return void 0;
+}
+var TOOLS_RPC_ID = `${PLUGIN_ID2}.tools`;
+var UNATTENDED = "A script cannot answer an approval prompt; this needs an allow rule for the session's agent.";
+var MESSAGE_ID = "msg_script";
+var UPSTREAM_LIMIT = 300;
+var object = (properties, required) => ({
+  type: "object",
+  properties,
+  required,
+  additionalProperties: false
+});
+var STRING = { type: "string" };
+var ANY_OBJECT = { type: "object" };
+var NO_INPUT = object({}, []);
+var FAILED = object({ code: STRING, next: STRING }, ["code", "next"]);
+var mcpOutput = (output = {}) => object({ output, text: STRING }, ["text"]);
+var DESCRIBED = object(
+  {
+    name: STRING,
+    tool: STRING,
+    kind: { type: "string", enum: ["mcp", "plugin"] },
+    action: STRING,
+    description: STRING,
+    available: { type: "boolean" },
+    reason: STRING,
+    input: ANY_OBJECT,
+    output: ANY_OBJECT
+  },
+  ["name", "tool", "kind", "action", "description", "available", "input", "output"]
+);
+var DESCRIPTION = object({ id: STRING, call: STRING, location: STRING, methods: { type: "array", items: DESCRIBED } }, [
+  "id",
+  "call",
+  "location",
+  "methods"
+]);
+var plainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var ENVELOPE_MESSAGES = {
+  notObject: `the envelope must be an object, such as {"sessionID":"<session>","input":<the tool's input>}`,
+  unknownKey: (key) => `"${key}" is not allowed`,
+  sessionID: `"sessionID" must be a non-empty string`,
+  account: `"account" must be a non-empty string`,
+  inputMissing: `"input" is missing`,
+  inputNotObject: `"input" must be an object`,
+  describe: "describe takes no input"
+};
+var standard = (schema, validate) => Object.defineProperty({ ...schema }, "~standard", { value: { version: 1, vendor: "tools-rpc", validate }, enumerable: false });
+var DESCRIBE_INPUT = standard(
+  NO_INPUT,
+  (value) => value === void 0 || value === null || plainObject(value) && Object.keys(value).length === 0 ? { value } : { issues: [{ message: ENVELOPE_MESSAGES.describe }] }
+);
+function strict(schema, issues) {
+  const keys = Object.keys(schema["properties"]);
+  return standard(schema, (value) => {
+    if (!plainObject(value)) return { issues: [{ message: ENVELOPE_MESSAGES.notObject }] };
+    const found = [...Object.keys(value).filter((key) => !keys.includes(key)).map(ENVELOPE_MESSAGES.unknownKey), ...issues(value)];
+    return found.length === 0 ? { value } : { issues: found.map((message) => ({ message })) };
+  });
+}
+var ScriptError = class extends Error {
+  failure;
+  constructor(failure) {
+    super(`${failure.code}: ${failure.what.replace(/[.\s]+$/, "")}. Next step: ${failure.next}`);
+    this.failure = failure;
+  }
+};
+var fail = (code2, what) => new ScriptError({ code: code2, what, next: NEXT_STEPS[code2] });
+var record2 = (value) => typeof value === "object" && value !== null;
+function notFound(error, tags) {
+  if (!record2(error)) return false;
+  const tag = error["_tag"] ?? error["name"];
+  return typeof tag === "string" && tags.includes(tag) || error["status"] === 404 || error["statusCode"] === 404;
+}
+var toolError2 = (error) => record2(error) && error["_tag"] === "Tool.Error";
+var requestAction = (cause) => {
+  const request = record2(cause) ? cause["request"] : void 0;
+  return record2(request) && typeof request["action"] === "string" && request["action"] !== "" ? request["action"] : void 0;
+};
+var wildcard = (pattern, value) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`).test(value);
+var hidden = (rules, action) => rules.findLast((rule) => wildcard(rule.action, action) && wildcard(rule.resource, "*"))?.effect === "deny";
+var SECRETS = [
+  [/\b(bearer|basic|token)\s+[\w.~+/=-]{8,}/gi, "$1 [redacted]"],
+  [/\b([\w-]*(?:api[_-]?key|access[_-]?key|private[_-]?key|token|secret|password|signature|credential)["']?\s*[:=]\s*)["']?[^\s"'&,;]+["']?/gi, "$1[redacted]"],
+  [/\beyJ[\w-]{4,}\.[\w-]{4,}\.[\w-]{4,}/g, "[redacted]"],
+  [/\b(?:tvly|sk|pk|rk|ghp|gho|ghu|ghs|ghr|github_pat|glpat|xox[abposr]|lin_api|lin_oauth)[-_][\w-]{8,}/gi, "[redacted]"],
+  [/[\w+=-]{40,}/g, "[redacted]"]
+];
+var withoutQuery = (text3) => text3.replace(/\bhttps?:\/\/[^\s"'<>()]+/gi, (url) => {
+  const cut = url.search(/[?#]/);
+  return cut === -1 ? url : `${url.slice(0, cut)}?[redacted]`;
+});
+function upstreamText(text3) {
+  const line = text3.split(/\r?\n/).find((part) => part.trim() !== "")?.trim() ?? "no message";
+  const redacted = SECRETS.reduce((value, [pattern, replacement]) => value.replace(pattern, replacement), withoutQuery(line));
+  return redacted.length <= UPSTREAM_LIMIT ? redacted : `${redacted.slice(0, UPSTREAM_LIMIT - 1)}\u2026`;
+}
+var jsonSchema = (schema) => record2(schema) && !("ast" in schema) && !("~standard" in schema) ? schema : void 0;
+function normalise(result) {
+  const text3 = typeof result.content === "string" ? result.content : (result.content ?? []).flatMap((part) => part.type === "text" ? [part.text] : []).join("\n");
+  return result.output === void 0 ? { text: text3 } : { output: result.output, text: text3 };
+}
+function connection(status) {
+  switch (status) {
+    case "connected":
+      return void 0;
+    case "pending":
+      return "CONNECTING";
+    case "needs_auth":
+      return "AUTH_REQUIRED";
+    case "failed":
+      return "CONNECTION_FAILED";
+    case "disabled":
+      return "DISABLED";
+    default:
+      return "NOT_REGISTERED";
+  }
+}
+var STATUS_TEXT = {
+  CONNECTING: "is still connecting",
+  AUTH_REQUIRED: "needs a sign-in",
+  CONNECTION_FAILED: "could not connect",
+  DISABLED: "is disabled",
+  NOT_REGISTERED: "is not registered"
+};
+async function registerToolsRpc(ctx, options) {
+  const { mcp, owned = [] } = options;
+  const accounts = typeof mcp?.server === "function";
+  if (KNOWN_READS.length > 0 && !mcp) throw new Error("registerToolsRpc: KNOWN_READS needs the mcp option");
+  if (accounts && NEXT_STEPS.ACCOUNT_UNKNOWN === void 0) throw new Error("registerToolsRpc: per-account servers need NEXT_STEPS.ACCOUNT_UNKNOWN");
+  const names = [...KNOWN_READS, ...owned.map((method) => method.name)];
+  const duplicate = names.find((name, index) => name === "describe" || names.indexOf(name) !== index);
+  if (duplicate) throw new Error(`registerToolsRpc: the method name "${duplicate}" is taken`);
+  const live = /* @__PURE__ */ new Set();
+  const refused = /* @__PURE__ */ new Map();
+  const serverOf = (account) => {
+    const server = typeof mcp.server === "function" ? mcp.server(account) : mcp.server;
+    if (server !== void 0) return server;
+    throw new ScriptError({ code: "ACCOUNT_UNKNOWN", what: `there is no account '${account}'`, next: NEXT_STEPS.ACCOUNT_UNKNOWN });
+  };
+  const session = async (sessionID) => {
+    let info;
+    try {
+      info = await ctx.session.get({ sessionID });
+    } catch (error) {
+      if (notFound(error, ["Session.NotFoundError", "SessionNotFoundError"])) throw fail("SESSION_UNKNOWN", `there is no session '${sessionID}'`);
+      throw error;
+    }
+    if (!info.agent) throw fail("SESSION_AGENT_REQUIRED", `session '${sessionID}' names no agent`);
+    let agent;
+    try {
+      agent = await ctx.agent.get({ agentID: info.agent, location: info.location });
+    } catch (error) {
+      if (notFound(error, ["Agent.NotFoundError", "AgentNotFoundError"])) throw fail("SESSION_AGENT_REQUIRED", `session '${sessionID}' names the agent '${info.agent}', which does not exist`);
+      throw error;
+    }
+    const rules = [...agent.data.permissions, ...info.permissions ?? []];
+    return { agent: info.agent, rules };
+  };
+  const unavailable = async (server, tool, connected) => {
+    const status = (await ctx.mcp.list()).data.find((entry) => entry.name === server)?.status.status;
+    const code2 = connection(status) ?? connected;
+    if (code2 === "TOOL_UNAVAILABLE") return fail(code2, `OpenCode does not list ${tool} on the connected "${server}" server`);
+    if (status === "connected") return fail(code2, `the "${server}" server was reconnecting when ${tool} ran`);
+    return fail(code2, `the "${server}" server ${STATUS_TEXT[code2] ?? "is unavailable"}`);
+  };
+  const denied = (action, error, asked = action) => {
+    const reason = upstreamText(record2(error) && typeof error["message"] === "string" ? error["message"] : String(error));
+    if (asked === action) return fail("PERMISSION_DENIED", `${action} was refused for this session's agent: ${reason}`);
+    return new ScriptError({
+      code: "PERMISSION_DENIED",
+      what: `${action} needs ${asked}, which was refused for this session's agent: ${reason}`,
+      next: `Add an allow rule for ${asked} to the session's agent or to the session, or use a session whose agent allows it.`
+    });
+  };
+  const mcpTarget = (name, envelope2) => {
+    const server = serverOf(envelope2.account);
+    const action = `${server}_${name}`;
+    return {
+      action,
+      mcp: true,
+      async run(call) {
+        if (!mcp.managed(server)) throw fail("SERVER_CONFLICT", `the "${server}" server in your config is not the one this plugin manages`);
+        const tool = (await ctx.tool.list()).find((entry) => entry.id === action);
+        if (!tool) throw await unavailable(server, action, "TOOL_UNAVAILABLE");
+        let result;
+        try {
+          result = await tool.execute(envelope2.input, call);
+        } catch (error) {
+          if (error instanceof Error && error.message.startsWith(`MCP server "${server}" `)) throw await unavailable(server, action, "CONNECTING");
+          throw error;
+        }
+        return shapeResult(name, normalise(result));
+      }
+    };
+  };
+  const ownedTarget = (spec, envelope2) => ({
+    action: spec.action,
+    mcp: false,
+    run: async (call) => await spec.run(envelope2.input, call) ?? null
+  });
+  const invoke = async (target, raw, context) => {
+    const envelope2 = raw;
+    let method;
+    let id;
+    try {
+      if (context.signal.aborted) throw fail("CANCELLED", "the call was cancelled");
+      method = target(envelope2);
+      const { agent, rules } = await session(envelope2.sessionID);
+      if (hidden(rules, method.action)) throw fail("PERMISSION_DENIED", `${method.action} is hidden from this session's agent by a deny rule`);
+      id = `script:${randomUUID()}`;
+      const call = {
+        sessionID: envelope2.sessionID,
+        agent,
+        messageID: MESSAGE_ID,
+        id,
+        signal: context.signal,
+        progress: async () => {
+        }
+      };
+      live.add(call.id);
+      try {
+        return JSON.parse(JSON.stringify(await method.run(call)));
+      } finally {
+        live.delete(call.id);
+      }
+    } catch (error) {
+      const failure = refusal(error, method, context.signal, id === void 0 ? void 0 : refused.get(id));
+      if (!failure) throw error;
+      return context.error("failed", new ScriptError(failure).message, { code: failure.code, next: failure.next });
+    } finally {
+      if (id !== void 0) refused.delete(id);
+    }
+  };
+  const refusal = (error, method, signal, asked) => {
+    if (signal.aborted) return fail("CANCELLED", "the call was cancelled").failure;
+    if (error instanceof ScriptError) return error.failure;
+    const own = pluginError(error);
+    if (own || !method || !toolError2(error)) return own;
+    if (error.error !== void 0) return denied(method.action, error, requestAction(error.error) ?? asked).failure;
+    if (method.mcp) return fail("UPSTREAM_ERROR", `${method.action} failed: ${upstreamText(error.message)}`).failure;
+    return void 0;
+  };
+  const describe2 = async () => {
+    const tools = mcp ? await ctx.tool.list() : [];
+    const methods = [];
+    if (mcp) {
+      const server = serverOf(void 0);
+      const managed = mcp.managed(server);
+      const status = managed ? (await ctx.mcp.list()).data.find((entry) => entry.name === server)?.status.status : void 0;
+      for (const name of KNOWN_READS) {
+        const id = `${server}_${name}`;
+        const tool = managed ? tools.find((entry) => entry.id === id) : void 0;
+        const reason = !managed ? "SERVER_CONFLICT" : tool ? void 0 : connection(status) ?? "TOOL_UNAVAILABLE";
+        const input = jsonSchema(tool?.input) ?? ANY_OBJECT;
+        const output = jsonSchema(tool?.output);
+        methods.push({
+          name,
+          tool: id,
+          kind: "mcp",
+          action: id,
+          description: tool?.description ?? "",
+          available: reason === void 0,
+          ...reason ? { reason } : {},
+          input,
+          output: mcpOutput(output)
+        });
+      }
+    }
+    for (const spec of owned) {
+      const reason = await spec.available?.();
+      methods.push({
+        name: spec.name,
+        tool: spec.name,
+        kind: "plugin",
+        action: spec.action,
+        description: spec.description,
+        available: reason === void 0,
+        ...reason === void 0 ? {} : { reason },
+        input: spec.input,
+        output: spec.output
+      });
+    }
+    return JSON.parse(
+      JSON.stringify({
+        id: TOOLS_RPC_ID,
+        call: `POST /api/rpc/${TOOLS_RPC_ID}/<method> with {"input":{"sessionID":"<session>",${accounts ? `"account":"<account>",` : ""}"input":<the tool's input>}}`,
+        location: ctx.location.directory,
+        methods
+      })
+    );
+  };
+  const envelope = (input, objectInput) => strict(
+    object({ sessionID: { type: "string", minLength: 1 }, ...accounts ? { account: { type: "string", minLength: 1 } } : {}, input }, ["sessionID", "input"]),
+    (value) => [
+      ...typeof value["sessionID"] === "string" && value["sessionID"] !== "" ? [] : [ENVELOPE_MESSAGES.sessionID],
+      ...value["account"] === void 0 || typeof value["account"] === "string" && value["account"] !== "" ? [] : [ENVELOPE_MESSAGES.account],
+      ...!("input" in value) ? [ENVELOPE_MESSAGES.inputMissing] : objectInput && !plainObject(value["input"]) ? [ENVELOPE_MESSAGES.inputNotObject] : []
+    ]
+  );
+  const contract = Rpc2.define({
+    id: TOOLS_RPC_ID,
+    methods: {
+      describe: { input: DESCRIBE_INPUT, output: DESCRIPTION },
+      ...Object.fromEntries(KNOWN_READS.map((name) => [name, { input: envelope(ANY_OBJECT, true), output: mcpOutput(), errors: { failed: FAILED } }])),
+      ...Object.fromEntries(owned.map((spec) => [spec.name, { input: envelope(spec.input, false), output: spec.output, errors: { failed: FAILED } }]))
+    },
+    events: {}
+  });
+  const handlers = {
+    describe: () => describe2(),
+    ...Object.fromEntries(KNOWN_READS.map((name) => [name, (raw, context) => invoke((envelope2) => mcpTarget(name, envelope2), raw, context)])),
+    ...Object.fromEntries(owned.map((spec) => [spec.name, (raw, context) => invoke((envelope2) => ownedTarget(spec, envelope2), raw, context)]))
+  };
+  const registration = await ctx.rpc.register(contract, handlers);
+  const hook = await ctx.permission.hook("evaluate", (evaluation) => {
+    if (evaluation.source === void 0 || !live.has(evaluation.source.id) || evaluation.effect === "allow") return;
+    refused.set(evaluation.source.id, evaluation.action);
+    if (evaluation.effect !== "ask") return;
+    evaluation.effect = "deny";
+    evaluation.message = UNATTENDED;
+  });
+  return async () => {
+    await hook.dispose().catch(() => void 0);
+    await registration.dispose().catch(() => void 0);
+  };
+}
+
 // src/commands.ts
 var STATUS_COMMAND = "granola-status";
 async function registerCommands(ctx, status) {
@@ -681,7 +1133,7 @@ function decode(text3) {
 function isMarkup(text3) {
   return new RegExp(`<${NAME}[\\s/>]`).test(text3);
 }
-function parse(text3) {
+function parse2(text3) {
   const root = { name: "", attributes: {}, children: [] };
   const stack = [root];
   const append = (value) => {
@@ -731,7 +1183,7 @@ var HEADINGS = {
   transcript: "Granola meeting transcripts",
   both: "Granola meeting notes and transcripts"
 };
-var UNAVAILABLE = {
+var UNAVAILABLE2 = {
   /** Not one of Granola's reasons: the notes read found no meeting and the transcript read failed. */
   meeting_not_found: "Granola returned no meeting for this ID",
   transcript_pending: "Granola is still processing it; export again in a few minutes",
@@ -809,7 +1261,7 @@ function blocks(parent) {
   return result;
 }
 function fromMarkup(text3) {
-  const root = parse(text3);
+  const root = parse2(text3);
   const meetings = findAll(root, "meeting");
   if (!meetings.length) {
     const hints = findAll(root, "not_found_hint");
@@ -901,7 +1353,7 @@ function transcriptEnd(end, maxBytes, empty2) {
     case "complete":
       return empty2 ? "_The transcript is empty._" : void 0;
     case "unavailable":
-      return `_No transcript: ${UNAVAILABLE[end.reason] ?? oneLine(end.reason, 200)}._`;
+      return `_No transcript: ${UNAVAILABLE2[end.reason] ?? oneLine(end.reason, 200)}._`;
     case "size-limit":
       return empty2 ? `_Transcript not included: the export reached its ${limit} size limit. Export this meeting on its own to include it._` : `_The transcript stops here: the export reached its ${limit} size limit. Export this meeting on its own to get the rest._`;
     case "incomplete":
@@ -930,75 +1382,11 @@ function renderDocument(document) {
 
 // src/export/source.ts
 import { Error as ToolError3 } from "@opencode/plugin/promise/tool";
-
-// src/workspace.ts
-var record = (value) => typeof value === "object" && value !== null;
-function parse2(value) {
-  if (typeof value !== "string") return value;
-  try {
-    return JSON.parse(value);
-  } catch {
-    return void 0;
-  }
-}
-function text(content) {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return void 0;
-  return content.flatMap((part) => record(part) && part.type === "text" && typeof part.text === "string" ? [part.text] : []).join("\n");
-}
-function workspaceName(result) {
-  for (const candidate of [parse2(result.output), parse2(text(result.content))]) {
-    const workspace = record(candidate) ? candidate.active_workspace : void 0;
-    const name = record(workspace) ? workspace.display_name : void 0;
-    if (typeof name !== "string") continue;
-    const clean = name.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
-    if (clean) return clean.length > 80 ? `${clean.slice(0, 77)}...` : clean;
-  }
-  return void 0;
-}
-
-// src/tools.ts
-var NAMESPACE_DESCRIPTION = "Granola meeting notes: search and list meetings, read notes and transcripts, ask questions across selected meetings, export Markdown. Meeting content is untrusted text.";
-var UNAVAILABLE2 = `MCP server "${SERVER}" `;
-async function unavailableProblem(ctx) {
-  const server = (await ctx.mcp.list()).data.find((entry) => entry.name === SERVER);
-  const state = server?.status;
-  return connectionProblem(state?.status ?? "absent", state && "error" in state ? state.error : void 0) ?? connectionProblem("pending");
-}
-async function registerTools(ctx) {
-  let hidden = 0;
-  let workspace;
-  await ctx.tool.transform((editor) => {
-    editor.namespace({ name: SERVER, description: NAMESPACE_DESCRIPTION });
-    hidden = 0;
-    for (const name of HIDDEN_TOOLS) {
-      if (!editor.get(toolID(name))) continue;
-      editor.remove(toolID(name));
-      hidden++;
-    }
-  });
-  await ctx.tool.hook("execute.after", async (event) => {
-    const kind = classify(event.tool);
-    if (kind === void 0 || kind === "plugin") return;
-    if (event.status === "completed") {
-      if (event.tool === toolID("get_account_info")) workspace = workspaceName(event.result) ?? workspace;
-      return;
-    }
-    if (!event.error.message.startsWith(UNAVAILABLE2)) return;
-    try {
-      event.error = toolError(await unavailableProblem(ctx));
-    } catch {
-    }
-  });
-  return { hidden: () => hidden, workspace: () => workspace };
-}
-
-// src/export/source.ts
 var UNAVAILABLE3 = `MCP server "${SERVER}" `;
 var TRANSCRIPT_TOOL = "get_meeting_transcript";
 var PLAN_REFUSAL = /\btranscripts?\b[^.]*\bpaid\b/i;
 var NOT_ON_PLAN = "not_on_plan";
-var record2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var record3 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 async function executor(ctx, name) {
   const tool = (await ctx.tool.list()).find((entry) => entry.id === toolID(name));
   if (tool) return tool;
@@ -1013,12 +1401,12 @@ function text2(result) {
   return (result.content ?? []).flatMap((part) => part.type === "text" ? [part.text] : []).join("\n");
 }
 function structured(result) {
-  if (record2(result.output)) return result.output;
+  if (record3(result.output)) return result.output;
   const body = text2(result).trim();
   if (!body.startsWith("{")) return void 0;
   try {
     const value = JSON.parse(body);
-    return record2(value) ? value : void 0;
+    return record3(value) ? value : void 0;
   } catch {
     return void 0;
   }
@@ -1027,7 +1415,7 @@ function readPage(result) {
   const value = structured(result);
   if (!value || !("transcript" in value)) return { text: text2(result), endsMidUtterance: false };
   const transcript = typeof value.transcript === "string" ? value.transcript : null;
-  const unavailable = record2(value.transcript_unavailable) ? value.transcript_unavailable.reason : value.transcript_unavailable;
+  const unavailable = record3(value.transcript_unavailable) ? value.transcript_unavailable.reason : value.transcript_unavailable;
   const next = value.truncated === true && Number.isSafeInteger(value.next_offset) ? value.next_offset : void 0;
   return {
     text: transcript,
@@ -1356,14 +1744,11 @@ function satisfies(version, range) {
     return order === 0;
   });
 }
-function checkHost(version, tested, allowUntested) {
-  if (satisfies(version, tested)) return { version, tested };
-  if (!allowUntested) throw new GranolaError(hostUntested(tested, version));
-  return {
-    version,
-    tested,
-    warning: `outside the tested line ${tested}; it runs because allowUntestedHost is true`
-  };
+function checkHost(version, range, allowUntested) {
+  const tested = TESTED_HOSTS.includes(version);
+  if (satisfies(version, range)) return { version, range, tested };
+  if (!allowUntested) throw new GranolaError(hostUntested(range, version));
+  return { version, range, tested, warning: `outside the supported range ${range}; it runs because allowUntestedHost is true` };
 }
 
 // src/integration.ts
@@ -1397,13 +1782,13 @@ async function registerIntegration(ctx, conflict) {
     const id = server?.integrationID;
     if (!server || !id || stopped.signal.aborted) return;
     if (id !== attached || (await ctx.integration.get({ integrationID: id })).data.name !== DISPLAY_NAME) await attach(id);
-    const connection = await ctx.integration.connection.active(id);
-    if (connection?.type !== "credential") return;
+    const connection2 = await ctx.integration.connection.active(id);
+    if (connection2?.type !== "credential") return;
     const state = server.status.status;
-    if (state === "needs_auth" && connection.status?.status !== "needs_auth") {
-      await ctx.integration.connection.status({ integrationID: id, connection, status: { status: "needs_auth", message: SIGN_IN_MESSAGE } });
-    } else if (state === "connected" && connection.status) {
-      await ctx.integration.connection.status({ integrationID: id, connection, status: void 0 });
+    if (state === "needs_auth" && connection2.status?.status !== "needs_auth") {
+      await ctx.integration.connection.status({ integrationID: id, connection: connection2, status: { status: "needs_auth", message: SIGN_IN_MESSAGE } });
+    } else if (state === "connected" && connection2.status) {
+      await ctx.integration.connection.status({ integrationID: id, connection: connection2, status: void 0 });
     }
   };
   let checking;
@@ -1503,7 +1888,15 @@ function parseOptions(raw, home = homedir()) {
 
 // src/rpc/register.ts
 async function registerRpc(ctx, status) {
-  await ctx.rpc.register(Granola, { status: () => status.read() });
+  await ctx.rpc.register(Granola, {
+    status: async (_input, context) => {
+      try {
+        return await status.read();
+      } catch {
+        return context.error("unavailable", describe(STATUS_UNAVAILABLE), { code: STATUS_UNAVAILABLE.code, next: STATUS_UNAVAILABLE.next });
+      }
+    }
+  });
 }
 
 // src/server.ts
@@ -1560,10 +1953,10 @@ async function registerSkills(ctx, skills = readSkills()) {
 }
 
 // src/setup.ts
-async function setup(ctx) {
+async function setup(ctx, toolsRpc) {
   const info = readPackageInfo();
   const options = parseOptions(ctx.options);
-  const host = checkHost(ctx.app.version, info.testedHost, options.allowUntestedHost);
+  const host = checkHost(ctx.app.version, info.hostRange, options.allowUntestedHost);
   const server = await registerServer(ctx);
   const integration = await registerIntegration(ctx, server.conflict);
   await registerPermissions(ctx);
@@ -1573,7 +1966,7 @@ async function setup(ctx) {
     workspace: tools?.workspace(),
     conflict: server.conflict(),
     exportDirectory: options.exportDirectory,
-    pluginVersion: info.version,
+    version: info.version,
     host
   }));
   tools = await registerTools(ctx);
@@ -1581,11 +1974,16 @@ async function setup(ctx) {
   await registerSkills(ctx);
   await registerExport(ctx, options);
   await registerRpc(ctx, status);
-  return () => integration.dispose();
+  const stopTools = await toolsRpc({ mcp: { server: SERVER, managed: () => server.conflict() === void 0 } });
+  return async () => {
+    tools?.dispose();
+    await stopTools();
+    await integration.dispose();
+  };
 }
 
 // src/index.ts
-var src_default = Plugin.define({ id: PLUGIN_ID, setup });
+var src_default = Plugin.define({ id: PLUGIN_ID, setup: (ctx) => setup(ctx, (options) => registerToolsRpc(ctx, options)) });
 export {
   src_default as default
 };