@joe-broadhead/opencode-granola 0.0.1 → 0.0.2

package/CHANGELOG.md

@@ -2,6 +2,61 @@
 
 All notable changes to this project are documented here. The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and versions follow [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.0.2] - 2026-11-04
+
+### Added
+
+- OpenCode 2.2.5 is a tested release, next to 2.2.3 and 2.2.4.
+- The status RPC (`granola.meetings` `status`) has `version`, the plugin's version, and `host.range` and
+  `host.tested`. A status it cannot read is now the RPC error `unavailable` with `STATUS_UNAVAILABLE` and its next
+  step, and the `/granola` dialog says so.
+
+### Changed
+
+- The status RPC uses the field names every plugin of this family shares. Scripts that read it need these changes:
+  - `next` is now `nextStep`;
+  - `pluginVersion` is now `version`;
+  - `hostVersion` is now `host.version`, which is `null` when OpenCode reports no version;
+  - `state` uses the shared states: `pending` is now `connecting`, `needs_auth` is now `sign_in_required`, `absent`
+    is now `not_configured`, and the user's own `granola` server for another URL is now `conflict` (it was that
+    server's connection state, next to `conflict`);
+  - `problem` no longer has `next`: the one next step is `nextStep`;
+  - `tools.visible` counts every Granola tool the model can call, unknown ones included.
+- On a release inside `>=2.2.3 <2.3.0` other than 2.2.3, 2.2.4 and 2.2.5, Granola still sets everything up, and only
+  the `OpenCode` row calls the version untested. The row reads, for example,
+  `2.2.5 (tested; supported range >=2.2.3 <2.3.0), plugin <version>`. On a host outside the range that runs because
+  of `allowUntestedHost`, the next step, when nothing else is needed, says to use a tested release if Granola
+  misbehaves.
+- Status always shows the `Agents without default rules` row, with `none` when no agent needs the fix. It lists an
+  agent only when its own rules would let a Granola tool this plugin does not know run without asking; an agent
+  whose rules already ask or deny for every Granola tool is not listed.
+- The sign-in next step says to press `o` or Enter to open the sign-in page. A disabled server's next step offers
+  `/mcps` first. A missing server's next step points at an organisation policy (`mcp.use`) or another plugin that
+  removes it, not at the plugins list.
+- The tools RPC's `describe` takes no input: anything but `{}` or nothing now gets `describe takes no input`. An
+  envelope that is not an object gets `the envelope must be an object, such as {…}`.
+- A refused permission check now names the action that was refused, when it is not the method's own.
+
+### Fixed
+
+- A failed connection's reason no longer ends in doubled punctuation, as in `…access the url?.`.
+- The README's sign-in check quoted a status line that does not exist. It now says the `Connection` row shows
+  `connected` and the `Tools` row how many Granola tools are available.
+- The README said Explore is left unchanged. Explore and Title also get the block; their own later deny rules still
+  keep Granola's tools out.
+- The README's Uninstall now says why to sign out first: once the plugin is removed, `opencode mcp logout granola`
+  answers "MCP server not found" and the sign-in stays in OpenCode's credential store. It signs out, checks with
+  `opencode auth list`, then removes the plugin, reloads, and checks with `opencode mcp list`.
+- The README now says what to do after `opencode plugin add` (run `opencode reload`, then `/granola-status`), how to
+  update the plugin, and, under Troubleshooting, that Granola's free plan returns only the last 30 days of meetings.
+- `docs/scripting.md` said `opencode api` runs in the directory you call it from. It runs in the OpenCode service's
+  default location, your home directory; the doc now says how to target a project. It also says that `opencode api`
+  exits with status 1 for an RPC error, and that a result with only text has that text as its `output`.
+- The `granola` skill now names the `folder_id` filter of `search_meetings` and `list_meetings`.
+- A script's call that found Granola disconnected, while Granola reads connected again by the time the plugin looks,
+  now gets `CONNECTING` and "Retry in a few seconds.", as the model does. It got `CONNECTION_FAILED` and a reconnect
+  step before.
+
 ## [0.0.1] - 2026-11-03
 
 ### Added

package/README.md

@@ -7,7 +7,8 @@ Unofficial; not affiliated with Granola.
 
 ## Requirements
 
-- OpenCode `>=2.2.3 <2.3.0`, tested on 2.2.3 and 2.2.4. On another version the plugin refuses to start; see
+- OpenCode `>=2.2.3 <2.3.0`, tested on 2.2.3, 2.2.4 and 2.2.5. Another release inside that range runs, and status
+  calls it untested. Outside the range the plugin does not start, unless you set `allowUntestedHost`; see
   [Troubleshooting](#troubleshooting).
 - macOS or Linux.
 - A Granola account. Granola's free plan includes the last 30 days of meeting history; transcripts and folders are
@@ -19,13 +20,19 @@ Unofficial; not affiliated with Granola.
 opencode plugin add @joe-broadhead/opencode-granola
 ```
 
-This adds the plugin to your global OpenCode config. Restart OpenCode afterwards.
+This adds the plugin to your global OpenCode config. Run `opencode reload`, or restart OpenCode. Then run
+`/granola-status`: it shows `sign-in required` until you sign in.
+
+**Update** with `opencode plugin update @joe-broadhead/opencode-granola`, then run `opencode reload`. An entry pinned to
+a version, such as `@joe-broadhead/opencode-granola@0.0.1`, does not update: remove the `@version` from its `plugins`
+entry first.
 
 ## Sign in
 
 1. Run `/connect` and choose **Granola**, listed under MCP.
 2. Press `o` or Enter to open Granola's sign-in page in your browser, then approve there.
-3. Run `/granola-status`. It shows `Granola: connected` and the number of Granola tools available.
+3. Run `/granola-status`. Its `Connection` row shows `connected`, and its `Tools` row shows how many Granola tools
+   are available.
 
 On the CLI, `opencode mcp auth granola` opens the sign-in page automatically. `/mcps` works too. There is
 nothing to configure first: Granola registers OpenCode's sign-in itself.
@@ -84,8 +91,9 @@ See [Scripting](https://github.com/joe-broadhead/opencode-granola/blob/HEAD/docs
 | Hidden | `sign_out` | removed; use `opencode mcp logout granola` |
 
 The plugin inserts these rules into each agent, directly after the agent's base "allow everything" rule. Your own
-`permissions` and your saved "Always allow" answers override them, and a `deny` you configure always wins. Agents
-without the base rule, such as Explore, are left unchanged, and Plan keeps its restrictions.
+`permissions` and your saved "Always allow" answers override them, and a `deny` you configure always wins. Explore
+and Title also get the block, but their own later deny rules still keep Granola tools out, and Plan keeps its
+restrictions. An agent without a base "allow everything" rule gets no rules.
 
 For example, to let one write run without asking:
 
@@ -99,7 +107,8 @@ For example, to let one write run without asking:
 
 Agents defined only in your own config are created after plugins start, so they miss the default rules, and Granola's
 writes would run there without asking. Status names each such agent and gives the block to paste first in that agent's
-own `permissions`. Do not put the block in the top-level `permissions`, which would loosen Explore.
+own `permissions`. An agent whose own rules already ask or deny for every Granola tool needs nothing and is not named.
+Do not put the block in the top-level `permissions`, which would loosen Explore.
 
 In `opencode run` and other runs where nobody can answer, a call that would ask is refused; reads still work.
 
@@ -132,26 +141,33 @@ Each member then signs in once with `/connect` → Granola. A managed `mcp.serve
 
 ## Troubleshooting
 
-Each connection state, as `/granola-status` shows it:
+Run `/granola-status` (or `/granola` in the terminal UI) first. It shows the rows `Connection`, `Account`, `Access`,
+`Export folder`, `Tools`, `Agents without default rules` (`none` when no agent needs the fix), `OpenCode` and exactly
+one `Next step`. Each connection state:
 
 | Status | Code | What to do |
 | --- | --- | --- |
-| not configured | `NOT_REGISTERED` | Retry in a few seconds; if it persists, check that `plugins` in your OpenCode config lists the Granola plugin and that no `mcp.servers.granola` entry points elsewhere. |
+| not configured | `NOT_REGISTERED` | Retry in a few seconds; if it persists, check that no organisation policy (`mcp.use`) or other plugin removes the `granola` server, then restart OpenCode. |
 | connecting | `CONNECTING` | Retry in a few seconds. |
-| sign-in required | `AUTH_REQUIRED` | Run `/connect` and choose Granola, or run `opencode mcp auth granola` in a terminal. |
+| sign-in required | `AUTH_REQUIRED` | Run `/connect` and choose Granola, then press `o` or Enter to open the sign-in page. In a terminal, `opencode mcp auth granola` opens it automatically. |
 | failed | `CONNECTION_FAILED` | Reconnect Granola from `/mcps`, and if it keeps failing, run `/connect` and choose Granola to sign in again. |
-| disabled | `DISABLED` | Remove `disabled: true` from `mcp.servers.granola` in your OpenCode config. |
+| disabled | `DISABLED` | Enable `granola` in `/mcps`, or remove `"disabled": true` from `mcp.servers.granola` in your OpenCode config. |
 | conflict | none | Remove `mcp.servers.granola` from your OpenCode config to use Granola's official server. |
+| connected | none | Ready. The next step reads `Nothing to do.`, or names agents without default rules. |
 
 **`MCP server not found: granola` from `opencode mcp auth granola`, right after OpenCode starts.** Plugins are still
 loading for a few seconds. Run it again, or use `/connect`, which updates live.
 
+**Older meetings are missing.** On Granola's free plan, Granola's server returns only the meetings of the last 30 days.
+
 **A tool says your Granola plan does not include it, or `TOOL_UNAVAILABLE`.** Granola's free plan has no
-transcripts or folders, and covers the last 30 days of meetings. Older meetings are not found.
+transcripts or folders.
 
-**`HOST_UNTESTED`.** The plugin refuses to start on an OpenCode version outside `>=2.2.3 <2.3.0`, including
-development builds. Use a tested OpenCode version, or set the plugin option `allowUntestedHost: true` to run anyway;
-status then shows `host untested`.
+**`HOST_UNTESTED`.** The plugin does not start on an OpenCode version outside `>=2.2.3 <2.3.0`, including
+development builds. Use OpenCode `>=2.2.3 <2.3.0`, or set the plugin option `allowUntestedHost: true` to run anyway;
+the `OpenCode` row then says `host untested`, and when nothing else is needed the next step says to use a tested
+release if Granola misbehaves. A release inside the range other than 2.2.3, 2.2.4 and 2.2.5 runs normally: only the
+`OpenCode` row calls it untested.
 
 **`OPTIONS_INVALID`.** A plugin option has an unknown name or a wrong type. The message names the option.
 
@@ -168,12 +184,16 @@ supports one Granola account.
 
 ## Uninstall
 
-```sh
-opencode mcp logout granola
-opencode plugin remove @joe-broadhead/opencode-granola
-```
+Sign out while the plugin is still installed: once it is removed, OpenCode no longer knows the `granola` server, so
+it cannot remove its sign-in, and `opencode auth list` stops showing it.
+
+1. Sign out of Granola: `opencode mcp logout granola`.
+2. Check: `opencode auth list` no longer lists **Granola**.
+3. Remove the plugin: `opencode plugin remove @joe-broadhead/opencode-granola`, then `opencode reload`.
+   `opencode mcp list` no longer lists `granola`.
+4. Remove any Granola rules you copied into your agents' own `permissions`.
 
-Restart OpenCode afterwards. Files you exported stay in your export folder.
+Files you exported stay in your export folder.
 
 ## Links
 

package/dist/index.js

@@ -7,7 +7,7 @@ import { Rpc as Rpc2 } from "@opencode/plugin/rpc";
 
 // src/errors.ts
 import { Error as ToolError } from "@opencode/plugin/promise/tool";
-var SIGN_IN_STEPS = "Run /connect and choose Granola, or run opencode mcp auth granola in a terminal.";
+var SIGN_IN_STEPS = "Run /connect and choose Granola, then press o or Enter to open the sign-in page (in a terminal, opencode mcp auth granola opens it automatically).";
 function describe(problem) {
   return `${problem.code}: ${problem.message} Next step: ${problem.next}`;
 }
@@ -29,6 +29,7 @@ function shortReason(text3) {
   if (!reason) return "no reason given";
   return reason.length > 160 ? `${reason.slice(0, 157)}...` : reason;
 }
+var sentence = (reason) => /[.?!]$/.test(reason) ? reason : `${reason}.`;
 function connectionProblem(state, error) {
   switch (state) {
     case "connected":
@@ -37,7 +38,7 @@ function connectionProblem(state, error) {
       return {
         code: "NOT_REGISTERED",
         message: "The Granola connection isn't registered yet.",
-        next: "Retry in a few seconds; if it persists, check that plugins in your OpenCode config lists the Granola plugin and that no mcp.servers.granola entry points elsewhere."
+        next: "Retry in a few seconds; if it persists, check that no organisation policy (mcp.use) or other plugin removes the granola server, then restart OpenCode."
       };
     case "pending":
       return { code: "CONNECTING", message: "Granola is still connecting.", next: "Retry in a few seconds." };
@@ -46,14 +47,14 @@ function connectionProblem(state, error) {
     case "failed":
       return {
         code: "CONNECTION_FAILED",
-        message: `Granola connection failed: ${shortReason(error)}.`,
+        message: `Granola connection failed: ${sentence(shortReason(error))}`,
         next: "Reconnect Granola from /mcps, and if it keeps failing, run /connect and choose Granola to sign in again."
       };
     case "disabled":
       return {
         code: "DISABLED",
-        message: "Granola is disabled in your OpenCode config.",
-        next: "Remove disabled: true from mcp.servers.granola in your OpenCode config."
+        message: "Granola is disabled in OpenCode.",
+        next: 'Enable granola in /mcps, or remove "disabled": true from mcp.servers.granola in your OpenCode config.'
       };
   }
 }
@@ -76,11 +77,11 @@ function invalidOption(key, problem) {
     next: "Fix the Granola plugin options in your OpenCode config, then reload OpenCode."
   };
 }
-function hostUntested(tested, found) {
+function hostUntested(range, found) {
   return {
     code: "HOST_UNTESTED",
-    message: `The Granola plugin is tested with OpenCode ${tested}, found ${found}.`,
-    next: "Use a tested OpenCode version, or set the plugin option allowUntestedHost to true to run anyway."
+    message: `The Granola plugin supports OpenCode ${range}, found ${found || "no version"}.`,
+    next: `Use OpenCode ${range}, or set the plugin option allowUntestedHost to true to run anyway.`
   };
 }
 function skillsInvalid(path3) {
@@ -142,7 +143,7 @@ function readPackageInfo(url = new URL("../package.json", import.meta.url)) {
   if (!record4(raw) || typeof raw.version !== "string" || !record4(raw.opencode) || typeof raw.opencode.host !== "string") {
     throw new GranolaError(packageInvalid("needs a version and an opencode.host range"));
   }
-  return { version: raw.version, testedHost: raw.opencode.host };
+  return { version: raw.version, hostRange: raw.opencode.host };
 }
 
 // src/permissions.ts
@@ -169,15 +170,12 @@ function matches(input, pattern) {
   const source = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
   return new RegExp(`^${source}$`, "s").test(input);
 }
-function winner(action, rules) {
-  return rules.findLast((rule) => matches(action, rule.action) && matches("*", rule.resource));
+function evaluate(rules, action) {
+  return rules.findLast((rule) => matches(action, rule.action) && matches("*", rule.resource))?.effect ?? "ask";
 }
-var SIDE_EFFECTS = [...WRITE_TOOLS.map(toolID), toolID("unknown_tool")];
+var UNKNOWN_TOOL = toolID("unknown_tool");
 function unguardedAgents(agents) {
-  return agents.filter((agent) => !hasDefaults(agent.permissions)).filter((agent) => SIDE_EFFECTS.some((action) => {
-    const rule = winner(action, agent.permissions);
-    return rule?.effect === "allow" && !rule.action.startsWith("granola");
-  })).map((agent) => agent.id);
+  return agents.filter((agent) => agent.permissions.some(isBaseAllow) && !hasDefaults(agent.permissions) && evaluate(agent.permissions, UNKNOWN_TOOL) === "allow").map((agent) => agent.id);
 }
 async function registerPermissions(ctx) {
   await ctx.agent.transform((editor) => {
@@ -187,18 +185,34 @@ async function registerPermissions(ctx) {
 
 // src/rpc/contract.ts
 import { Rpc } from "@opencode/plugin/rpc";
+var STATES = ["connected", "sign_in_required", "connecting", "disabled", "failed", "not_configured", "conflict"];
+var STATE_OF = {
+  connected: "connected",
+  pending: "connecting",
+  needs_auth: "sign_in_required",
+  failed: "failed",
+  disabled: "disabled",
+  absent: "not_configured"
+};
 var STATUS_SCHEMA = {
   type: "object",
   additionalProperties: false,
-  required: ["state", "tools", "unguardedAgents", "exportDirectory", "pluginVersion", "hostVersion", "next"],
+  required: ["version", "host", "state", "tools", "unguardedAgents", "exportDirectory", "nextStep"],
   properties: {
-    state: { type: "string", enum: ["connected", "pending", "disabled", "failed", "needs_auth", "absent"] },
+    version: { type: "string" },
+    host: {
+      type: "object",
+      additionalProperties: false,
+      required: ["version", "range", "tested"],
+      properties: { version: { type: ["string", "null"] }, range: { type: "string" }, tested: { type: "boolean" } }
+    },
+    state: { type: "string", enum: STATES },
     title: { type: "string" },
     problem: {
       type: "object",
       additionalProperties: false,
-      required: ["code", "message", "next"],
-      properties: { code: { type: "string" }, message: { type: "string" }, next: { type: "string" } }
+      required: ["code", "message"],
+      properties: { code: { type: "string" }, message: { type: "string" } }
     },
     conflict: { type: "string" },
     tools: {
@@ -228,31 +242,43 @@ var STATUS_SCHEMA = {
       }
     },
     exportDirectory: { type: "string" },
-    pluginVersion: { type: "string" },
-    hostVersion: { type: "string" },
     hostWarning: { type: "string" },
-    next: { type: "string" }
+    nextStep: { type: "string" }
   }
 };
+var STATUS_ERROR_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["code", "next"],
+  properties: { code: { type: "string" }, next: { type: "string" } }
+};
 var STATE_LABELS = {
   connected: "connected",
-  pending: "connecting",
-  needs_auth: "sign-in required",
+  connecting: "connecting",
+  sign_in_required: "sign-in required",
   failed: "failed",
   disabled: "disabled",
-  absent: "not configured"
+  not_configured: "not configured",
+  conflict: "conflict"
 };
 var TONES = {
   connected: "ok",
-  pending: "info",
-  needs_auth: "warning",
+  connecting: "info",
+  sign_in_required: "warning",
   failed: "error",
   disabled: "info",
-  absent: "warning"
+  not_configured: "warning",
+  conflict: "warning"
 };
+function hostRow(status) {
+  const { version, range, tested } = status.host;
+  const found = version ?? "unknown";
+  if (status.hostWarning) return { label: "OpenCode", text: `${found} (host untested: ${status.hostWarning}), plugin ${status.version}`, tone: "warning" };
+  return { label: "OpenCode", text: `${found} (${tested ? "tested" : "untested"}; supported range ${range}), plugin ${status.version}`, ...tested ? {} : { tone: "info" } };
+}
 function statusRows(status) {
   const connected = status.state === "connected";
-  const connection2 = status.conflict ? `conflict: ${status.conflict}` : `${STATE_LABELS[status.state]}${status.title ? ` (${status.title})` : ""}${status.problem ? `: ${status.problem.message} (${status.problem.code})` : ""}`;
+  const connection2 = status.state === "conflict" && status.conflict ? `conflict: ${status.conflict}` : `${STATE_LABELS[status.state]}${status.title ? ` (${status.title})` : ""}${status.problem ? `: ${status.problem.message} (${status.problem.code})` : ""}`;
   const tools = [`${status.tools.visible} available`];
   if (status.tools.hidden) tools.push(`${status.tools.hidden} hidden`);
   if (status.tools.unknown) {
@@ -261,18 +287,18 @@ function statusRows(status) {
   }
   const agents = status.unguardedAgents;
   return [
-    { label: "Connection", text: connection2, tone: status.conflict ? "warning" : TONES[status.state] },
+    { label: "Connection", text: connection2, tone: TONES[status.state] },
     { label: "Account", text: !connected ? "unknown until Granola connects" : status.workspace ? `workspace ${status.workspace}` : "workspace unknown until the agent reads your Granola account" },
     { label: "Access", text: "reads run without asking; changes, new tools and exports ask first" },
     { label: "Export folder", text: status.exportDirectory },
     { label: "Tools", text: connected ? tools.join(", ") : "none until Granola connects" },
-    ...agents.length ? [{
+    agents.length ? {
       label: "Agents without default rules",
-      text: `${agents.join(", ")}: Granola writes run there without asking`,
+      text: `${agents.join(", ")}: Granola changes and new tools may run there without asking`,
       tone: "warning",
       block: permissionsSnippet(agents, status.permissionsBlock ?? [])
-    }] : [],
-    status.hostWarning ? { label: "OpenCode", text: `${status.hostVersion} (host untested: ${status.hostWarning}), plugin ${status.pluginVersion}`, tone: "warning" } : { label: "OpenCode", text: `${status.hostVersion} (tested), plugin ${status.pluginVersion}` }
+    } : { label: "Agents without default rules", text: "none" },
+    hostRow(status)
   ];
 }
 function permissionsSnippet(agents, block2) {
@@ -294,34 +320,41 @@ var Granola = Rpc.define({
   methods: {
     status: {
       input: { type: "object", properties: {}, additionalProperties: false },
-      output: STATUS_SCHEMA
+      output: STATUS_SCHEMA,
+      errors: { unavailable: STATUS_ERROR_SCHEMA }
     }
   },
   events: {}
 });
 
+// src/hosts.ts
+var TESTED_HOSTS = ["2.2.3", "2.2.4", "2.2.5"];
+
 // src/status.ts
 var LISTED_UNKNOWN = 20;
 var SAFE_NAME = /^[a-z][a-z0-9_]{0,63}$/;
 var CONFLICT_NEXT = "Remove mcp.servers.granola from your OpenCode config to use Granola's official server.";
 var NOTHING_TO_DO = "Nothing to do.";
+var UNTESTED_HOST_NEXT = `If Granola misbehaves, use OpenCode ${TESTED_HOSTS.slice(0, -1).join(", ")} or ${TESTED_HOSTS.at(-1)}.`;
 function agentFix(agents) {
   const where = agents.map((agent) => `agents.${agent}.permissions`).join(", ");
   return `Put the Granola block first in that agent's own permissions (${where}), followed by your top-level rules for granola_ actions.`;
 }
 function buildStatus(inputs) {
   const server = inputs.servers.find((entry) => entry.name === SERVER);
-  const state = server?.status.status ?? "absent";
-  const problem = connectionProblem(state, server?.status.error);
+  const connection2 = server?.status.status ?? "absent";
+  const problem = inputs.conflict ? void 0 : connectionProblem(connection2, server?.status.error);
   const classes = inputs.tools.map((tool) => ({ id: tool.id, kind: classify(tool.id) }));
   const unknown = classes.filter((tool) => tool.kind === "unknown").map((tool) => tool.id.slice(SERVER.length + 1));
-  const visible = classes.filter((tool) => tool.kind === "read" || tool.kind === "write").length;
+  const visible = classes.filter((tool) => tool.kind === "read" || tool.kind === "write" || tool.kind === "unknown").length;
   const unguarded = unguardedAgents(inputs.agents);
-  const next = (inputs.conflict ? CONFLICT_NEXT : void 0) ?? problem?.next ?? (unguarded.length ? agentFix(unguarded) : void 0) ?? NOTHING_TO_DO;
+  const nextStep = (inputs.conflict ? CONFLICT_NEXT : void 0) ?? problem?.next ?? (unguarded.length ? agentFix(unguarded) : void 0) ?? (inputs.host.warning ? UNTESTED_HOST_NEXT : void 0) ?? NOTHING_TO_DO;
   return {
-    state,
-    ...state === "connected" && server?.title ? { title: server.title } : {},
-    ...problem ? { problem } : {},
+    version: inputs.version,
+    host: { version: inputs.host.version || null, range: inputs.host.range, tested: inputs.host.tested },
+    state: inputs.conflict ? "conflict" : STATE_OF[connection2],
+    ...connection2 === "connected" && !inputs.conflict && server?.title ? { title: server.title } : {},
+    ...problem ? { problem: { code: problem.code, message: problem.message } } : {},
     ...inputs.conflict ? { conflict: inputs.conflict } : {},
     tools: {
       visible,
@@ -333,10 +366,8 @@ function buildStatus(inputs) {
     unguardedAgents: unguarded,
     ...unguarded.length ? { permissionsBlock: DEFAULT_RULES.map((rule) => ({ ...rule })) } : {},
     exportDirectory: inputs.exportDirectory,
-    pluginVersion: inputs.pluginVersion,
-    hostVersion: inputs.host.version,
     ...inputs.host.warning ? { hostWarning: inputs.host.warning } : {},
-    next
+    nextStep
   };
 }
 function formatStatus(status) {
@@ -345,7 +376,7 @@ function formatStatus(status) {
     lines.push(`${row.label}: ${row.text}`);
     for (const line of row.block ?? []) lines.push(`  ${line}`);
   }
-  lines.push(`Next step: ${status.next}`);
+  lines.push(`Next step: ${status.nextStep}`);
   return lines.join("\n");
 }
 function createStatus(ctx, fixed) {
@@ -486,14 +517,27 @@ var DESCRIPTION = object({ id: STRING, call: STRING, location: STRING, methods:
   "methods"
 ]);
 var plainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+var ENVELOPE_MESSAGES = {
+  notObject: `the envelope must be an object, such as {"sessionID":"<session>","input":<the tool's input>}`,
+  unknownKey: (key) => `"${key}" is not allowed`,
+  sessionID: `"sessionID" must be a non-empty string`,
+  account: `"account" must be a non-empty string`,
+  inputMissing: `"input" is missing`,
+  inputNotObject: `"input" must be an object`,
+  describe: "describe takes no input"
+};
+var standard = (schema, validate) => Object.defineProperty({ ...schema }, "~standard", { value: { version: 1, vendor: "tools-rpc", validate }, enumerable: false });
+var DESCRIBE_INPUT = standard(
+  NO_INPUT,
+  (value) => value === void 0 || value === null || plainObject(value) && Object.keys(value).length === 0 ? { value } : { issues: [{ message: ENVELOPE_MESSAGES.describe }] }
+);
 function strict(schema, issues) {
   const keys = Object.keys(schema["properties"]);
-  const validate = (value) => {
-    if (!plainObject(value)) return { issues: [{ message: "Expected an object" }] };
-    const found = [...Object.keys(value).filter((key) => !keys.includes(key)).map((key) => `"${key}" is not allowed`), ...issues(value)];
+  return standard(schema, (value) => {
+    if (!plainObject(value)) return { issues: [{ message: ENVELOPE_MESSAGES.notObject }] };
+    const found = [...Object.keys(value).filter((key) => !keys.includes(key)).map(ENVELOPE_MESSAGES.unknownKey), ...issues(value)];
     return found.length === 0 ? { value } : { issues: found.map((message) => ({ message })) };
-  };
-  return Object.defineProperty({ ...schema }, "~standard", { value: { version: 1, vendor: "tools-rpc", validate }, enumerable: false });
+  });
 }
 var ScriptError = class extends Error {
   failure;
@@ -510,6 +554,10 @@ function notFound(error, tags) {
   return typeof tag === "string" && tags.includes(tag) || error["status"] === 404 || error["statusCode"] === 404;
 }
 var toolError2 = (error) => record2(error) && error["_tag"] === "Tool.Error";
+var requestAction = (cause) => {
+  const request = record2(cause) ? cause["request"] : void 0;
+  return record2(request) && typeof request["action"] === "string" && request["action"] !== "" ? request["action"] : void 0;
+};
 var wildcard = (pattern, value) => new RegExp(`^${pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".")}$`).test(value);
 var hidden = (rules, action) => rules.findLast((rule) => wildcard(rule.action, action) && wildcard(rule.resource, "*"))?.effect === "deny";
 var SECRETS = [
@@ -565,6 +613,7 @@ async function registerToolsRpc(ctx, options) {
   const duplicate = names.find((name, index) => name === "describe" || names.indexOf(name) !== index);
   if (duplicate) throw new Error(`registerToolsRpc: the method name "${duplicate}" is taken`);
   const live = /* @__PURE__ */ new Set();
+  const refused = /* @__PURE__ */ new Map();
   const serverOf = (account) => {
     const server = typeof mcp.server === "function" ? mcp.server(account) : mcp.server;
     if (server !== void 0) return server;
@@ -593,11 +642,17 @@ async function registerToolsRpc(ctx, options) {
     const status = (await ctx.mcp.list()).data.find((entry) => entry.name === server)?.status.status;
     const code2 = connection(status) ?? connected;
     if (code2 === "TOOL_UNAVAILABLE") return fail(code2, `OpenCode does not list ${tool} on the connected "${server}" server`);
+    if (status === "connected") return fail(code2, `the "${server}" server was reconnecting when ${tool} ran`);
     return fail(code2, `the "${server}" server ${STATUS_TEXT[code2] ?? "is unavailable"}`);
   };
-  const denied = (action, error) => {
-    const reason = record2(error) && typeof error["message"] === "string" ? error["message"] : String(error);
-    return fail("PERMISSION_DENIED", `${action} was refused for this session's agent: ${upstreamText(reason)}`);
+  const denied = (action, error, asked = action) => {
+    const reason = upstreamText(record2(error) && typeof error["message"] === "string" ? error["message"] : String(error));
+    if (asked === action) return fail("PERMISSION_DENIED", `${action} was refused for this session's agent: ${reason}`);
+    return new ScriptError({
+      code: "PERMISSION_DENIED",
+      what: `${action} needs ${asked}, which was refused for this session's agent: ${reason}`,
+      next: `Add an allow rule for ${asked} to the session's agent or to the session, or use a session whose agent allows it.`
+    });
   };
   const mcpTarget = (name, envelope2) => {
     const server = serverOf(envelope2.account);
@@ -613,7 +668,7 @@ async function registerToolsRpc(ctx, options) {
         try {
           result = await tool.execute(envelope2.input, call);
         } catch (error) {
-          if (error instanceof Error && error.message.startsWith(`MCP server "${server}" `)) throw await unavailable(server, action, "CONNECTION_FAILED");
+          if (error instanceof Error && error.message.startsWith(`MCP server "${server}" `)) throw await unavailable(server, action, "CONNECTING");
           throw error;
         }
         return shapeResult(name, normalise(result));
@@ -628,16 +683,18 @@ async function registerToolsRpc(ctx, options) {
   const invoke = async (target, raw, context) => {
     const envelope2 = raw;
     let method;
+    let id;
     try {
       if (context.signal.aborted) throw fail("CANCELLED", "the call was cancelled");
       method = target(envelope2);
       const { agent, rules } = await session(envelope2.sessionID);
       if (hidden(rules, method.action)) throw fail("PERMISSION_DENIED", `${method.action} is hidden from this session's agent by a deny rule`);
+      id = `script:${randomUUID()}`;
       const call = {
         sessionID: envelope2.sessionID,
         agent,
         messageID: MESSAGE_ID,
-        id: `script:${randomUUID()}`,
+        id,
         signal: context.signal,
         progress: async () => {
         }
@@ -649,17 +706,19 @@ async function registerToolsRpc(ctx, options) {
         live.delete(call.id);
       }
     } catch (error) {
-      const failure = refusal(error, method, context.signal);
+      const failure = refusal(error, method, context.signal, id === void 0 ? void 0 : refused.get(id));
       if (!failure) throw error;
       return context.error("failed", new ScriptError(failure).message, { code: failure.code, next: failure.next });
+    } finally {
+      if (id !== void 0) refused.delete(id);
     }
   };
-  const refusal = (error, method, signal) => {
+  const refusal = (error, method, signal, asked) => {
     if (signal.aborted) return fail("CANCELLED", "the call was cancelled").failure;
     if (error instanceof ScriptError) return error.failure;
     const own = pluginError(error);
     if (own || !method || !toolError2(error)) return own;
-    if (error.error !== void 0) return denied(method.action, error).failure;
+    if (error.error !== void 0) return denied(method.action, error, requestAction(error.error) ?? asked).failure;
     if (method.mcp) return fail("UPSTREAM_ERROR", `${method.action} failed: ${upstreamText(error.message)}`).failure;
     return void 0;
   };
@@ -689,8 +748,20 @@ async function registerToolsRpc(ctx, options) {
         });
       }
     }
-    for (const spec of owned)
-      methods.push({ name: spec.name, tool: spec.name, kind: "plugin", action: spec.action, description: spec.description, available: true, input: spec.input, output: spec.output });
+    for (const spec of owned) {
+      const reason = await spec.available?.();
+      methods.push({
+        name: spec.name,
+        tool: spec.name,
+        kind: "plugin",
+        action: spec.action,
+        description: spec.description,
+        available: reason === void 0,
+        ...reason === void 0 ? {} : { reason },
+        input: spec.input,
+        output: spec.output
+      });
+    }
     return JSON.parse(
       JSON.stringify({
         id: TOOLS_RPC_ID,
@@ -703,15 +774,15 @@ async function registerToolsRpc(ctx, options) {
   const envelope = (input, objectInput) => strict(
     object({ sessionID: { type: "string", minLength: 1 }, ...accounts ? { account: { type: "string", minLength: 1 } } : {}, input }, ["sessionID", "input"]),
     (value) => [
-      ...typeof value["sessionID"] === "string" && value["sessionID"] !== "" ? [] : [`"sessionID" must be a non-empty string`],
-      ...value["account"] === void 0 || typeof value["account"] === "string" && value["account"] !== "" ? [] : [`"account" must be a non-empty string`],
-      ...!("input" in value) ? [`"input" is missing`] : objectInput && !plainObject(value["input"]) ? [`"input" must be an object`] : []
+      ...typeof value["sessionID"] === "string" && value["sessionID"] !== "" ? [] : [ENVELOPE_MESSAGES.sessionID],
+      ...value["account"] === void 0 || typeof value["account"] === "string" && value["account"] !== "" ? [] : [ENVELOPE_MESSAGES.account],
+      ...!("input" in value) ? [ENVELOPE_MESSAGES.inputMissing] : objectInput && !plainObject(value["input"]) ? [ENVELOPE_MESSAGES.inputNotObject] : []
     ]
   );
   const contract = Rpc2.define({
     id: TOOLS_RPC_ID,
     methods: {
-      describe: { input: NO_INPUT, output: DESCRIPTION },
+      describe: { input: DESCRIBE_INPUT, output: DESCRIPTION },
       ...Object.fromEntries(KNOWN_READS.map((name) => [name, { input: envelope(ANY_OBJECT, true), output: mcpOutput(), errors: { failed: FAILED } }])),
       ...Object.fromEntries(owned.map((spec) => [spec.name, { input: envelope(spec.input, false), output: spec.output, errors: { failed: FAILED } }]))
     },
@@ -724,7 +795,9 @@ async function registerToolsRpc(ctx, options) {
   };
   const registration = await ctx.rpc.register(contract, handlers);
   const hook = await ctx.permission.hook("evaluate", (evaluation) => {
-    if (evaluation.effect !== "ask" || evaluation.source === void 0 || !live.has(evaluation.source.id)) return;
+    if (evaluation.source === void 0 || !live.has(evaluation.source.id) || evaluation.effect === "allow") return;
+    refused.set(evaluation.source.id, evaluation.action);
+    if (evaluation.effect !== "ask") return;
     evaluation.effect = "deny";
     evaluation.message = UNATTENDED;
   });
@@ -1671,14 +1744,11 @@ function satisfies(version, range) {
     return order === 0;
   });
 }
-function checkHost(version, tested, allowUntested) {
-  if (satisfies(version, tested)) return { version, tested };
-  if (!allowUntested) throw new GranolaError(hostUntested(tested, version));
-  return {
-    version,
-    tested,
-    warning: `outside the tested line ${tested}; it runs because allowUntestedHost is true`
-  };
+function checkHost(version, range, allowUntested) {
+  const tested = TESTED_HOSTS.includes(version);
+  if (satisfies(version, range)) return { version, range, tested };
+  if (!allowUntested) throw new GranolaError(hostUntested(range, version));
+  return { version, range, tested, warning: `outside the supported range ${range}; it runs because allowUntestedHost is true` };
 }
 
 // src/integration.ts
@@ -1818,7 +1888,15 @@ function parseOptions(raw, home = homedir()) {
 
 // src/rpc/register.ts
 async function registerRpc(ctx, status) {
-  await ctx.rpc.register(Granola, { status: () => status.read() });
+  await ctx.rpc.register(Granola, {
+    status: async (_input, context) => {
+      try {
+        return await status.read();
+      } catch {
+        return context.error("unavailable", describe(STATUS_UNAVAILABLE), { code: STATUS_UNAVAILABLE.code, next: STATUS_UNAVAILABLE.next });
+      }
+    }
+  });
 }
 
 // src/server.ts
@@ -1878,7 +1956,7 @@ async function registerSkills(ctx, skills = readSkills()) {
 async function setup(ctx, toolsRpc) {
   const info = readPackageInfo();
   const options = parseOptions(ctx.options);
-  const host = checkHost(ctx.app.version, info.testedHost, options.allowUntestedHost);
+  const host = checkHost(ctx.app.version, info.hostRange, options.allowUntestedHost);
   const server = await registerServer(ctx);
   const integration = await registerIntegration(ctx, server.conflict);
   await registerPermissions(ctx);
@@ -1888,7 +1966,7 @@ async function setup(ctx, toolsRpc) {
     workspace: tools?.workspace(),
     conflict: server.conflict(),
     exportDirectory: options.exportDirectory,
-    pluginVersion: info.version,
+    version: info.version,
     host
   }));
   tools = await registerTools(ctx);

package/dist/tui.js

@@ -4,18 +4,26 @@ import { createSignal } from "solid-js";
 
 // src/rpc/contract.ts
 import { Rpc } from "@opencode/plugin/rpc";
+var STATES = ["connected", "sign_in_required", "connecting", "disabled", "failed", "not_configured", "conflict"];
 var STATUS_SCHEMA = {
   type: "object",
   additionalProperties: false,
-  required: ["state", "tools", "unguardedAgents", "exportDirectory", "pluginVersion", "hostVersion", "next"],
+  required: ["version", "host", "state", "tools", "unguardedAgents", "exportDirectory", "nextStep"],
   properties: {
-    state: { type: "string", enum: ["connected", "pending", "disabled", "failed", "needs_auth", "absent"] },
+    version: { type: "string" },
+    host: {
+      type: "object",
+      additionalProperties: false,
+      required: ["version", "range", "tested"],
+      properties: { version: { type: ["string", "null"] }, range: { type: "string" }, tested: { type: "boolean" } }
+    },
+    state: { type: "string", enum: STATES },
     title: { type: "string" },
     problem: {
       type: "object",
       additionalProperties: false,
-      required: ["code", "message", "next"],
-      properties: { code: { type: "string" }, message: { type: "string" }, next: { type: "string" } }
+      required: ["code", "message"],
+      properties: { code: { type: "string" }, message: { type: "string" } }
     },
     conflict: { type: "string" },
     tools: {
@@ -45,31 +53,43 @@ var STATUS_SCHEMA = {
       }
     },
     exportDirectory: { type: "string" },
-    pluginVersion: { type: "string" },
-    hostVersion: { type: "string" },
     hostWarning: { type: "string" },
-    next: { type: "string" }
+    nextStep: { type: "string" }
   }
 };
+var STATUS_ERROR_SCHEMA = {
+  type: "object",
+  additionalProperties: false,
+  required: ["code", "next"],
+  properties: { code: { type: "string" }, next: { type: "string" } }
+};
 var STATE_LABELS = {
   connected: "connected",
-  pending: "connecting",
-  needs_auth: "sign-in required",
+  connecting: "connecting",
+  sign_in_required: "sign-in required",
   failed: "failed",
   disabled: "disabled",
-  absent: "not configured"
+  not_configured: "not configured",
+  conflict: "conflict"
 };
 var TONES = {
   connected: "ok",
-  pending: "info",
-  needs_auth: "warning",
+  connecting: "info",
+  sign_in_required: "warning",
   failed: "error",
   disabled: "info",
-  absent: "warning"
+  not_configured: "warning",
+  conflict: "warning"
 };
+function hostRow(status) {
+  const { version, range, tested } = status.host;
+  const found = version ?? "unknown";
+  if (status.hostWarning) return { label: "OpenCode", text: `${found} (host untested: ${status.hostWarning}), plugin ${status.version}`, tone: "warning" };
+  return { label: "OpenCode", text: `${found} (${tested ? "tested" : "untested"}; supported range ${range}), plugin ${status.version}`, ...tested ? {} : { tone: "info" } };
+}
 function statusRows(status) {
   const connected = status.state === "connected";
-  const connection = status.conflict ? `conflict: ${status.conflict}` : `${STATE_LABELS[status.state]}${status.title ? ` (${status.title})` : ""}${status.problem ? `: ${status.problem.message} (${status.problem.code})` : ""}`;
+  const connection = status.state === "conflict" && status.conflict ? `conflict: ${status.conflict}` : `${STATE_LABELS[status.state]}${status.title ? ` (${status.title})` : ""}${status.problem ? `: ${status.problem.message} (${status.problem.code})` : ""}`;
   const tools = [`${status.tools.visible} available`];
   if (status.tools.hidden) tools.push(`${status.tools.hidden} hidden`);
   if (status.tools.unknown) {
@@ -78,18 +98,18 @@ function statusRows(status) {
   }
   const agents = status.unguardedAgents;
   return [
-    { label: "Connection", text: connection, tone: status.conflict ? "warning" : TONES[status.state] },
+    { label: "Connection", text: connection, tone: TONES[status.state] },
     { label: "Account", text: !connected ? "unknown until Granola connects" : status.workspace ? `workspace ${status.workspace}` : "workspace unknown until the agent reads your Granola account" },
     { label: "Access", text: "reads run without asking; changes, new tools and exports ask first" },
     { label: "Export folder", text: status.exportDirectory },
     { label: "Tools", text: connected ? tools.join(", ") : "none until Granola connects" },
-    ...agents.length ? [{
+    agents.length ? {
       label: "Agents without default rules",
-      text: `${agents.join(", ")}: Granola writes run there without asking`,
+      text: `${agents.join(", ")}: Granola changes and new tools may run there without asking`,
       tone: "warning",
       block: permissionsSnippet(agents, status.permissionsBlock ?? [])
-    }] : [],
-    status.hostWarning ? { label: "OpenCode", text: `${status.hostVersion} (host untested: ${status.hostWarning}), plugin ${status.pluginVersion}`, tone: "warning" } : { label: "OpenCode", text: `${status.hostVersion} (tested), plugin ${status.pluginVersion}` }
+    } : { label: "Agents without default rules", text: "none" },
+    hostRow(status)
   ];
 }
 function permissionsSnippet(agents, block) {
@@ -111,7 +131,8 @@ var Granola = Rpc.define({
   methods: {
     status: {
       input: { type: "object", properties: {}, additionalProperties: false },
-      output: STATUS_SCHEMA
+      output: STATUS_SCHEMA,
+      errors: { unavailable: STATUS_ERROR_SCHEMA }
     }
   },
   events: {}
@@ -127,10 +148,10 @@ function view(details) {
   if (details.type === "unavailable") {
     return {
       rows: [{ label: "Connection", text: `unknown: ${details.reason}`, tone: "warning" }],
-      next: "Check that granola.meetings is active in /plugins, then press r to refresh."
+      next: details.next ?? "Check that granola.meetings is active in /plugins, then press r to refresh."
     };
   }
-  return { rows: statusRows(details.status), next: details.status.next };
+  return { rows: statusRows(details.status), next: details.status.nextStep };
 }
 
 // src/tui/view.tsx
@@ -275,9 +296,17 @@ function StatusDialog(props) {
 }
 
 // src/tui/index.tsx
-function reason(error) {
+function failure(error) {
   const type = typeof error === "object" && error !== null && "type" in error ? error.type : void 0;
-  return type === "rpc.unavailable" || type === "rpc.method_not_found" ? "the Granola plugin is not running on this OpenCode server" : "the status request failed";
+  if (type === "unavailable") return {
+    type: "unavailable",
+    reason: "Granola status could not be read (STATUS_UNAVAILABLE)",
+    next: "Press r to refresh in a few seconds."
+  };
+  return {
+    type: "unavailable",
+    reason: type === "rpc.unavailable" || type === "rpc.method_not_found" ? "the Granola plugin is not running on this OpenCode server" : "the status request failed"
+  };
 }
 var plugin = {
   id: "granola.meetings.tui",
@@ -297,10 +326,7 @@ var plugin = {
       } : {}).then((status) => ({
         type: "ready",
         status
-      }), (error) => ({
-        type: "unavailable",
-        reason: reason(error)
-      })).then((next) => {
+      }), failure).then((next) => {
         if (request === generation) setDetails(next);
       });
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joe-broadhead/opencode-granola",
-  "version": "0.0.1",
+  "version": "0.0.2",
   "description": "Unofficial OpenCode plugin for Granola meeting notes, through Granola's official MCP server",
   "keywords": [
     "opencode",

package/skills/granola/SKILL.md

@@ -22,7 +22,7 @@ For a brief before a meeting, or a catch-up on a person, company or topic, also
 - `search_meetings`: by keyword, participant or company, and date. Keywords match titles, summaries and the user's notes, not transcripts, so an empty result does not mean that a topic was never discussed.
 - `list_meetings`: meetings in a date range, newest first (the last 7 days by default), optionally in one folder.
 - `search_transcripts`: by keyword in what was said; it returns matching transcript passages. Not every Granola plan includes transcripts.
-- `list_meeting_folders`: folders and their IDs, for the folder filter of both tools above.
+- `list_meeting_folders`: folders and their IDs, for the `folder_id` filter of `search_meetings` and `list_meetings`.
 - Results come in pages. While a response offers a next cursor, continue with it and the same filters before you say that a meeting does not exist.
 
 ## Read meetings