@joe-broadhead/opencode-gws 0.0.1 → 0.0.3

package/dist/tui.js

@@ -19,6 +19,7 @@ var object = (properties, required) => ({ type: "object", properties, required }
 var MODES = ["interactive", "credentials_file", "access_token"];
 var ACCESS = ["read", "write"];
 var CLIENT_SOURCES = ["account", "plugin", "pasted"];
+var STATES = ["connected", "sign_in_required", "not_configured", "host_untested"];
 var account = object(
   {
     alias: text,
@@ -31,15 +32,16 @@ var account = object(
     clientSource: { enum: CLIENT_SOURCES },
     grantedScopes: texts,
     missingScopes: texts,
+    delegationRequired: texts,
     nextStep: text
   },
   ["alias", "mode", "services", "connected"]
 );
 var status = object(
   {
-    pluginVersion: text,
-    hostVersion: text,
-    hostWarning: text,
+    version: text,
+    host: object({ version: { type: ["string", "null"] }, range: text, tested: { type: "boolean" } }, ["version", "range", "tested"]),
+    state: { enum: STATES },
     gws: object({ path: text, version: text }, ["path", "version"]),
     services: texts,
     accounts: { type: "array", items: account },
@@ -48,7 +50,7 @@ var status = object(
     permissionsBlock: text,
     nextStep: text
   },
-  ["pluginVersion", "hostVersion", "gws", "services", "accounts", "unguardedAgents"]
+  ["version", "host", "state", "gws", "services", "accounts", "unguardedAgents", "nextStep"]
 );
 var Gws = Rpc.define({
   id: RPC_ID,
@@ -65,18 +67,23 @@ var isStrings = (value) => Array.isArray(value) && value.every((entry) => typeof
 var optional = (value, check) => value === void 0 || check(value);
 var isText = (value) => typeof value === "string";
 function isAccount(value) {
-  return isRecord(value) && isText(value["alias"]) && MODES.includes(value["mode"]) && isStrings(value["services"]) && typeof value["connected"] === "boolean" && optional(value["integrationID"], isText) && optional(value["needsAuth"], (entry) => entry === true) && optional(value["access"], (entry) => ACCESS.includes(entry)) && optional(value["clientSource"], (entry) => CLIENT_SOURCES.includes(entry)) && optional(value["grantedScopes"], isStrings) && optional(value["missingScopes"], isStrings) && optional(value["nextStep"], isText);
+  return isRecord(value) && isText(value["alias"]) && MODES.includes(value["mode"]) && isStrings(value["services"]) && typeof value["connected"] === "boolean" && optional(value["integrationID"], isText) && optional(value["needsAuth"], (entry) => entry === true) && optional(value["access"], (entry) => ACCESS.includes(entry)) && optional(value["clientSource"], (entry) => CLIENT_SOURCES.includes(entry)) && optional(value["grantedScopes"], isStrings) && optional(value["missingScopes"], isStrings) && optional(value["delegationRequired"], isStrings) && optional(value["nextStep"], isText);
 }
 function isStatus(value) {
-  return isRecord(value) && isText(value["pluginVersion"]) && isText(value["hostVersion"]) && optional(value["hostWarning"], isText) && isRecord(value["gws"]) && isText(value["gws"]["path"]) && isText(value["gws"]["version"]) && isStrings(value["services"]) && Array.isArray(value["accounts"]) && value["accounts"].every(isAccount) && optional(value["auditDegraded"], (entry) => typeof entry === "boolean") && isStrings(value["unguardedAgents"]) && optional(value["permissionsBlock"], isText) && optional(value["nextStep"], isText);
+  return isRecord(value) && isText(value["version"]) && isRecord(value["host"]) && (value["host"]["version"] === null || isText(value["host"]["version"])) && isText(value["host"]["range"]) && typeof value["host"]["tested"] === "boolean" && STATES.includes(value["state"]) && isRecord(value["gws"]) && isText(value["gws"]["path"]) && isText(value["gws"]["version"]) && isStrings(value["services"]) && Array.isArray(value["accounts"]) && value["accounts"].every(isAccount) && optional(value["auditDegraded"], (entry) => typeof entry === "boolean") && isStrings(value["unguardedAgents"]) && optional(value["permissionsBlock"], isText) && isText(value["nextStep"]);
 }
-var NOTHING_TO_DO = "Nothing to do.";
 function connectionLabel(account2) {
   if (account2.connected) return "connected";
   return account2.mode === "interactive" ? "sign-in required" : "not configured";
 }
 function openCodeLabel(status2) {
-  return status2.hostWarning ? `${status2.hostVersion} (host untested: ${status2.hostWarning})` : `${status2.hostVersion} (tested)`;
+  const version = status2.host.version ?? "unknown";
+  return status2.host.tested ? `${version} (tested)` : `${version} (host untested; supported range ${status2.host.range})`;
+}
+var DELEGATION_LABEL = "Needs domain-wide delegation";
+function delegationText(account2) {
+  const services = account2.delegationRequired ?? [];
+  return `${services.join(", ")} (a Workspace admin sets it up; then add the scopes to accounts.${account2.alias}.scopes)`;
 }
 var BLOCK_PLACEMENT = "Put this block first in that agent's own permissions, followed by your top-level rules for gws actions. Never put it in the top-level permissions: that would loosen Explore.";
 
@@ -248,6 +255,23 @@ function AccountStatus(props) {
         }
       })
     }), null);
+    _$insert(_el$4, _$createComponent(Show, {
+      get when() {
+        return _$memo(() => !!props.account.delegationRequired?.length)() ? props.account : void 0;
+      },
+      children: (account2) => _$createComponent(Row, {
+        label: DELEGATION_LABEL,
+        get value() {
+          return delegationText(account2());
+        },
+        get fg() {
+          return muted();
+        },
+        get muted() {
+          return muted();
+        }
+      })
+    }), null);
     return _el$4;
   })();
 }
@@ -374,7 +398,7 @@ function StatusBody(props) {
         return openCodeLabel(props.status);
       },
       get fg() {
-        return tone(props.status.hostWarning ? "warning" : "success");
+        return tone(props.status.host.tested ? "success" : "warning");
       },
       get muted() {
         return muted();
@@ -383,7 +407,7 @@ function StatusBody(props) {
     _$insert(_el$6, _$createComponent(Row, {
       label: "Next step",
       get value() {
-        return props.status.nextStep ?? NOTHING_TO_DO;
+        return props.status.nextStep;
       },
       get fg() {
         return base();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@joe-broadhead/opencode-gws",
-  "version": "0.0.1",
+  "version": "0.0.3",
   "description": "Unofficial OpenCode plugin for Google Workspace (gws CLI)",
   "type": "module",
   "license": "MIT",
@@ -28,7 +28,8 @@
     "dist",
     "skills",
     "manifest/generated.json",
-    "views",
+    "views/gmail-thread.html",
+    "views/jelly-view.js",
     "README.md",
     "LICENSE",
     "NOTICE",
@@ -50,10 +51,10 @@
     "docs:coverage": "node scripts/generate-docs.mjs"
   },
   "optionalDependencies": {
-    "@joe-broadhead/opencode-gws-bin-darwin-arm64": "0.0.1",
-    "@joe-broadhead/opencode-gws-bin-darwin-x64": "0.0.1",
-    "@joe-broadhead/opencode-gws-bin-linux-arm64-gnu": "0.0.1",
-    "@joe-broadhead/opencode-gws-bin-linux-x64-gnu": "0.0.1"
+    "@joe-broadhead/opencode-gws-bin-darwin-arm64": "0.0.3",
+    "@joe-broadhead/opencode-gws-bin-darwin-x64": "0.0.3",
+    "@joe-broadhead/opencode-gws-bin-linux-arm64-gnu": "0.0.3",
+    "@joe-broadhead/opencode-gws-bin-linux-x64-gnu": "0.0.3"
   },
   "devDependencies": {
     "@babel/core": "7.29.7",

package/skills/opencode-gws/SKILL.md

@@ -13,7 +13,7 @@ Call `gws_status` before the first Workspace call in a session. It lists account
 
 Omit `account` when `gws_status` shows one account. Pass the alias when it shows more than one. A missing alias is `ACCOUNT_REQUIRED`. An unknown alias is `ACCOUNT_UNKNOWN`.
 
-An account signs in Read-only or Read and write; `gws_status` shows which. The `default` account defaults to Read and write, which covers every method a Google sign-in can run. An operation whose scopes were not granted fails with `AUTH_SCOPE_MISSING` before anything runs: ask the user to sign in again, approve every scope Google lists, and choose Read and write if the error says so. Do not invent a scope. A method that `gws_catalog` or `gws_schema` marks `appOnly` needs a Chat app's or Classroom add-on's own credentials; no sign-in can run it, so use another method.
+An account signs in Read-only or Read and write; `gws_status` shows which. The `default` account defaults to Read and write, which covers every method a Google sign-in can run. An operation whose scopes were not granted fails with `AUTH_SCOPE_MISSING` before anything runs: ask the user to sign in again, approve every scope Google lists, and choose Read and write if the error says so. Do not invent a scope. A method that `gws_catalog` or `gws_schema` marks `appOnly` (`restriction: "app-only"`) needs a Chat app's or Classroom add-on's own credentials; no sign-in can run it, so use another method. A method marked `restriction: "domain-wide-delegation"` (every Keep method) runs only when a Workspace admin has set up domain-wide delegation and `accounts.<alias>.scopes` adds a Keep scope; otherwise tell the user so.
 
 Not signed in: `AUTH_REQUIRED`. The next step is to run `/connect` and choose Google Workspace, or `opencode auth login gws-<alias>`.
 
@@ -47,7 +47,7 @@ A change is two calls.
 | export | `gws_export` |
 | admin | `gws_admin` |
 
-The plan's category wins over the manifest. A Drive update whose body sets `trashed` to true is a delete: commit with `gws_delete`. A Calendar event write whose `sendUpdates` is `all` or `externalOnly` is a send: commit with `gws_send`. A read with `download.path` is an export: commit with `gws_export`.
+The plan's category wins over the manifest. A Drive update whose body sets `trashed` to true is a delete: commit with `gws_delete`. A Calendar event write whose `sendUpdates` is not `none`, or whose `sendNotifications` is true, emails the guests and is a send: commit with `gws_send`. A read with `download.path` is an export: commit with `gws_export`.
 
 Plans are single-use and bound to this session, agent, and account. `PLAN_EXPIRED`, `PLAN_ALREADY_USED`, and `PLAN_CALLER_MISMATCH` mean: read the current state, plan again, and show the new preview. `CATEGORY_MISMATCH` means you called the wrong commit tool.
 
@@ -115,10 +115,13 @@ An error is `CODE: What happened. Next step: What to do.` Do the next step once.
 | --- | --- |
 | `AUTH_REQUIRED` | Ask the user to sign in as the message says, then retry. |
 | `AUTH_SCOPE_MISSING` | Ask the user to sign in again with the access the message names, or to add the scope. Nothing ran. |
+| `ADMIN_PRIVILEGE_REQUIRED` | The sign-in is valid; the account lacks the Workspace admin privilege the API needs. Do not ask the user to sign in again as the same account. Tell them the message's next step. |
 | `API_DISABLED` | Ask the user to enable the API at the URL in the message, wait about a minute, and retry. |
 | `OPERATION_UNKNOWN` | The id is not in the catalog. Search again with `gws_catalog`. |
 | `HELPER_UNSUPPORTED` | The helper cannot run. Use the method `gws_catalog` names as `alternative`. |
 | `POLICY_DENIED` | Stop. Tell the user. Do not rephrase the call to get around the deny. |
+| `RECIPIENTS_UNKNOWN` | A recipient rule applies and the plugin could not tell who the send or share reaches. Name the recipients in `to`, `cc` and `bcc` (or the `To`, `Cc` and `Bcc` headers of `raw`) once; otherwise tell the user. |
+| `ACCOUNT_DOMAIN_UNKNOWN` | A rule refuses external recipients and the account's own domain is unknown. Tell the user the message's next step. |
 | `GWS_VALIDATION_ERROR` | Fix the request. `gws_schema` shows the parameters. List and search need `fields`. |
 | `CANCELLED` | Do not retry unless the user asks. A commit that was already running may have been applied. Check with `gws_read` before planning again. |
 | `SESSION_UNKNOWN` | A script named a session that does not exist. Have it create a session and keep that id. |

package/skills/opencode-gws-admin/SKILL.md

@@ -26,7 +26,7 @@ Plugin policy cannot allow an admin call. A policy rule can only deny.
 
 ## Admin reports
 
-Read-only at both access levels. The sign-in still needs the admin report scopes from the auth doc.
+Read-only at both access levels. The sign-in still needs the admin report scopes from the auth doc, and the account must be a Workspace admin with the Reports privilege: otherwise every call fails with `ADMIN_PRIVILEGE_REQUIRED`, which signing in again as the same account does not fix.
 
 Activity list, read. `fields` is required because this is a list:
 

package/skills/opencode-gws-recipes/SKILL.md

@@ -83,6 +83,8 @@ Reply. Same commit tool, `gws_send`:
 }
 ```
 
+The preview lists who the reply reaches: the sender, and for `gmail.reply-all` everyone else on the message. `to`, `cc` and `bcc` add recipients; `remove` leaves people out of a reply-all. `gmail.forward` takes `to`, `cc`, `bcc`, `body`, `attachments` and `noOriginalAttachments`. `gws_schema` lists every helper flag.
+
 ## Drive
 
 Recent files, read:
@@ -169,7 +171,7 @@ Create an event that does not email anyone. Plan category is write. Commit with
 }
 ```
 
-Create or move an event that emails attendees (`sendUpdates` of `all` or `externalOnly`). The plan category is **send**. Commit with `gws_send`.
+Create or move an event that emails attendees (`sendUpdates` of `all` or `externalOnly`; prefer it to the deprecated `sendNotifications`, which counts as a send too). The plan category is **send**. Commit with `gws_send`.
 
 ```json
 {

package/views/jelly-view.d.ts

@@ -1,73 +0,0 @@
-/**
- * The types of `jelly-view.js`, for a page written or checked with TypeScript:
- * `/// <reference path="./jelly-view.d.ts" />`. They mirror the bridge envelopes
- * in Jelly's contracts (`protocol/contracts/src/view-bridge.ts`); the page itself
- * carries only the JavaScript.
- */
-
-type JellyViewPlace = "tool-result" | "home-widget" | "settings-section";
-type JellyViewGrant = "data" | "state" | "rpc" | "open-agent";
-
-/** The fixed theme token set; the helper sets each as `--jelly-<name>` on the page. */
-interface JellyViewTheme {
-  text: string;
-  muted: string;
-  surface: string;
-  raised: string;
-  border: string;
-  accent: string;
-  "on-accent": string;
-  danger: string;
-  font: string;
-  radius: string;
-  scheme: "light" | "dark";
-}
-
-interface JellyViewHello {
-  v: 1;
-  kind: "hello";
-  /** `package` is null for a Home app an agent made. */
-  view: { package: string | null; id: string; title: string; place: JellyViewPlace };
-  grants: JellyViewGrant[];
-  /** The methods `call` may name. */
-  rpc: string[];
-  theme: JellyViewTheme;
-}
-
-/** A view's state: JSON of at most 64 KB, and the revision a write must name. */
-interface JellyViewState {
-  revision: number;
-  data: unknown;
-}
-
-type JellyViewPush =
-  | { v: 1; kind: "data.changed"; data: unknown }
-  | ({ v: 1; kind: "state.changed" } & JellyViewState)
-  | { v: 1; kind: "theme.changed"; theme: JellyViewTheme }
-  | { v: 1; kind: "visibility"; visible: boolean }
-  /** The call with request id `re` waits for the person, at most until `until` (ISO time). */
-  | { v: 1; kind: "rpc.waiting"; re: string; until: string };
-
-interface JellyView {
-  hello: JellyViewHello;
-  /** Hear pushes; returns the way to stop. */
-  on(listener: (push: JellyViewPush) => void): () => void;
-  /** Any request by its op, for one the helper has no name for. */
-  request(op: string, fields?: Record<string, unknown>): Promise<unknown>;
-  /** The place's data (the `data` grant). */
-  data(): Promise<unknown>;
-  /** The view's state (the `state` grant). */
-  state(): Promise<JellyViewState>;
-  /** Replace the state if `revision` is still the stored one; rejects on a conflict. */
-  setState(revision: number, data: unknown): Promise<JellyViewState>;
-  /** One of the methods the hello lists (the `rpc` grant). */
-  call(method: string, input?: unknown): Promise<unknown>;
-  /** Start a message for the person to send; it is never sent (the `open-agent` grant). */
-  openAgent(prefill?: string): Promise<null>;
-  /** The height the page needs, in CSS pixels, up to 1200: a hint the app may draw shorter. */
-  resize(height: number): Promise<null>;
-  /** Not mine: the app closes the frame and keeps its ordinary look. */
-  decline(): Promise<null>;
-}
-
-declare function jellyView(): Promise<JellyView>;