@joe-broadhead/opencode-gws 0.0.2 → 0.0.4

package/dist/index.js

@@ -5320,8 +5320,8 @@ function rewriteKeyNames(ctx) {
       bySchema.set(entry.schema, entry);
   }
   const rewrites = /* @__PURE__ */ new Map();
-  for (const record2 of pendingRecords.get(ctx) ?? []) {
-    const seen = ctx.seen.get(record2);
+  for (const record3 of pendingRecords.get(ctx) ?? []) {
+    const seen = ctx.seen.get(record3);
     const names = (seen?.def ?? seen?.schema)?.propertyNames;
     if (!names || names === true || rewrites.has(names))
       continue;
@@ -6575,9 +6575,17 @@ var ErrorCode = {
     meaning: "Plugin policy refused the call: the category, the service, recipients, public sharing, the admin gate, or a path outside the allowed roots. A deny is final.",
     next: "Do not work around it. If the message says to use gws_plan, plan the change; otherwise tell the user, who can change the plugin policy."
   },
+  RECIPIENTS_UNKNOWN: {
+    meaning: "A policy rule limits recipients, and the plugin could not tell who this send or share reaches: a raw message without readable To, Cc or Bcc headers, a draft, message or event it could not read, a draft that names no recipient, or a method whose recipients it does not know. Nothing ran.",
+    next: "Name the recipients in the request (to, cc and bcc, or the To, Cc and Bcc headers of raw), or tell the user the policy rule refuses this method."
+  },
+  ACCOUNT_DOMAIN_UNKNOWN: {
+    meaning: "A policy rule sets allowExternalRecipients to false, and the account's own email domain is unknown: accounts.<alias>.domains is unset and the signed-in address could not be read. Nothing ran.",
+    next: "Ask the user to set accounts.<alias>.domains to the account's email domains, or to enable Gmail, Drive or Calendar for the account so the plugin can read its address."
+  },
   // ── Plans ─────────────────────────────────────────────────────────────
   PLAN_NOT_FOUND: {
-    meaning: "No plan has this planId, or it was removed.",
+    meaning: "No plan has this planId: it never existed, or its time limit passed and it was removed.",
     next: "Create a plan with gws_plan, then commit its planId."
   },
   PLAN_ALREADY_USED: {
@@ -6599,15 +6607,15 @@ var ErrorCode = {
   // ── Scripts (the tools RPC) ───────────────────────────────────────────
   SESSION_UNKNOWN: {
     meaning: "A script named a session that does not exist. A script runs as a session, under that session's agent and its permission rules.",
-    next: "Pass the id of an existing session, or create one for the agent the script should run as."
+    next: 'Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.'
   },
   SESSION_AGENT_REQUIRED: {
     meaning: "A script named a session that names no agent. A script runs as its session's agent, so its permissions and plans never depend on the default agent.",
-    next: `Create the script's session with an agent, for example POST /api/session with {"agent":"build"}.`
+    next: 'Create a session that names an agent, such as POST /api/session with {"agent":"build"}, and pass its id.'
   },
   PERMISSION_DENIED: {
     meaning: "The permission rules of the session's agent deny the call, or ask for an approval that a script cannot give, so the call did not run.",
-    next: "Run the script as a session whose agent allows the action, or add an allow rule for that action to the agent."
+    next: "Add an allow rule for the tool to the session's agent or to the session, or use a session whose agent allows it."
   },
   // ── Sign-in ───────────────────────────────────────────────────────────
   AUTH_REQUIRED: {
@@ -6619,7 +6627,7 @@ var ErrorCode = {
     next: "Ask the user to sign in again with the access the message names, or to add the scope to the account's scopes, then retry. For a method only an app's credentials can run, use another method."
   },
   ADMIN_PRIVILEGE_REQUIRED: {
-    meaning: "The sign-in is valid, but Google refused the call because the account lacks a Workspace admin privilege the API needs, such as Reports for admin-reports. Signing in again as the same account does not help, and the sign-in is not marked as needing renewal.",
+    meaning: "The sign-in is valid, but an Admin SDK service (admin-reports) refused the call because the account lacks a Workspace admin privilege the API needs, such as Reports. Signing in again as the same account does not help, and the sign-in is not marked as needing renewal. Another service's refusal is never this code.",
     next: "Ask the user to sign in with a Workspace admin account that has the needed privilege (Reports for admin-reports), or to remove the service from enabledServices."
   },
   AUTH_CLIENT_REQUIRED: {
@@ -6706,8 +6714,8 @@ var ErrorCode = {
   },
   // ── Setup: these stop the plugin from loading ────────────────────────
   HOST_UNTESTED: {
-    meaning: "The OpenCode version is outside the tested range in package.json opencode.host.",
-    next: "Use a tested OpenCode release, or set allowUntestedHost to true to run anyway with a status warning."
+    meaning: "The OpenCode version is outside the supported range in package.json opencode.host (>=2.2.3 <2.3.0).",
+    next: "Use OpenCode 2.2.3, 2.2.4 or 2.2.5 (tested) or another release in the range, or set allowUntestedHost to true to run anyway; status then shows the host as untested."
   },
   OPTIONS_INVALID: {
     meaning: "The plugin options are not valid: an unknown key, a wrong type, an unknown service, or access or scopes that name something the account does not enable.",
@@ -6772,8 +6780,8 @@ var GwsError = class _GwsError extends Error {
     return stated ? new _GwsError(code2, stated[1], { next: stated[2] }) : new _GwsError(code2, match[2]);
   }
 };
-function sentence(text3) {
-  const trimmed = text3.trim();
+function sentence(text4) {
+  const trimmed = text4.trim();
   const capital = trimmed.charAt(0).toUpperCase() + trimmed.slice(1);
   return /[.!?]$/.test(capital) ? capital : `${capital}.`;
 }
@@ -6973,22 +6981,29 @@ var replyBase = {
   messageId: string2().min(1),
   body: string2().min(1).max(1e5),
   from: string2().email().optional(),
+  to: union([string2(), array(string2())]).optional().describe("Extra To recipients, besides the ones the reply goes to"),
   cc: union([string2(), array(string2())]).optional(),
   bcc: union([string2(), array(string2())]).optional(),
   html: boolean2().optional(),
   draft: boolean2().optional(),
   attachments: array(absolutePath).max(20).optional()
 };
-function replyAdapter(id, name) {
+var replyAllBase = {
+  ...replyBase,
+  remove: union([string2(), array(string2())]).optional().describe("Addresses to leave out of the reply-all, the sender's included")
+};
+function replyAdapter(id, name, all) {
   return {
     id,
     service: "gmail",
     category: "send",
-    inputSchema: strictObject(replyBase),
+    inputSchema: strictObject(all ? replyAllBase : replyBase),
     build(input, request) {
       const parsed = this.inputSchema.parse(input);
       const argv = ["gmail", name, "--message-id", parsed.messageId, "--body", parsed.body];
       if (parsed.from) argv.push("--from", parsed.from);
+      if (parsed.to) argv.push("--to", emails(parsed.to).join(","));
+      if (parsed.remove) argv.push("--remove", emails(parsed.remove).join(","));
       if (parsed.cc) argv.push("--cc", emails(parsed.cc).join(","));
       if (parsed.bcc) argv.push("--bcc", emails(parsed.bcc).join(","));
       if (parsed.html) argv.push("--html");
@@ -7001,9 +7016,9 @@ function replyAdapter(id, name) {
         files,
         preview: {
           method: `gmail ${name}`,
-          params: { messageId: parsed.messageId, cc: emails(parsed.cc), bcc: emails(parsed.bcc) },
+          params: { messageId: parsed.messageId, to: emails(parsed.to), cc: emails(parsed.cc), bcc: emails(parsed.bcc), ...all ? { remove: emails(parsed.remove) } : {}, draft: parsed.draft ?? false },
           bodySummary: bytes(parsed.body),
-          recipients: [...emails(parsed.cc), ...emails(parsed.bcc)],
+          recipients: [...emails(parsed.to), ...emails(parsed.cc), ...emails(parsed.bcc)],
           uploads: parsed.attachments,
           account: request.account,
           category: "send"
@@ -7012,30 +7027,45 @@ function replyAdapter(id, name) {
     }
   };
 }
+var forwardSchema = strictObject({
+  messageId: string2().min(1),
+  to: union([string2(), array(string2())]),
+  cc: union([string2(), array(string2())]).optional(),
+  bcc: union([string2(), array(string2())]).optional(),
+  from: string2().email().optional(),
+  body: string2().max(1e5).optional().describe("A note above the forwarded message"),
+  html: boolean2().optional(),
+  draft: boolean2().optional(),
+  attachments: array(absolutePath).max(20).optional(),
+  noOriginalAttachments: boolean2().optional().describe("Leave out the original message's attachments")
+});
 var gmailForward = {
   id: "gmail.forward",
   service: "gmail",
   category: "send",
-  inputSchema: strictObject({
-    messageId: string2().min(1),
-    to: union([string2(), array(string2())]),
-    body: string2().max(1e5).optional(),
-    html: boolean2().optional()
-  }),
+  inputSchema: forwardSchema,
   build(input, request) {
     const parsed = this.inputSchema.parse(input);
     const argv = ["gmail", "+forward", "--message-id", parsed.messageId, "--to", emails(parsed.to).join(",")];
+    if (parsed.cc) argv.push("--cc", emails(parsed.cc).join(","));
+    if (parsed.bcc) argv.push("--bcc", emails(parsed.bcc).join(","));
+    if (parsed.from) argv.push("--from", parsed.from);
     if (parsed.body) argv.push("--body", parsed.body);
     if (parsed.html) argv.push("--html");
+    if (parsed.draft) argv.push("--draft");
+    if (parsed.noOriginalAttachments) argv.push("--no-original-attachments");
+    const files = attach(argv, parsed.attachments);
     return {
       id: this.id,
       category: "send",
       argv,
+      files,
       preview: {
         method: "gmail +forward",
-        params: { messageId: parsed.messageId, to: emails(parsed.to) },
+        params: { messageId: parsed.messageId, to: emails(parsed.to), cc: emails(parsed.cc), bcc: emails(parsed.bcc), draft: parsed.draft ?? false },
         bodySummary: parsed.body ? bytes(parsed.body) : void 0,
-        recipients: emails(parsed.to),
+        recipients: [...emails(parsed.to), ...emails(parsed.cc), ...emails(parsed.bcc)],
+        uploads: parsed.attachments,
         account: request.account,
         category: "send"
       }
@@ -7049,7 +7079,8 @@ var gmailTriage = {
   inputSchema: strictObject({
     max: number2().int().positive().max(200).optional(),
     query: string2().max(2e3).optional(),
-    labels: boolean2().optional()
+    labels: boolean2().optional(),
+    format: outputFormat.optional()
   }),
   build(input, request) {
     const parsed = this.inputSchema.parse(input);
@@ -7057,6 +7088,7 @@ var gmailTriage = {
     if (parsed.max) argv.push("--max", String(parsed.max));
     if (parsed.query) argv.push("--query", parsed.query);
     if (parsed.labels) argv.push("--labels");
+    if (parsed.format) argv.push("--format", parsed.format);
     return {
       id: this.id,
       category: "read",
@@ -7217,8 +7249,8 @@ var weeklyDigest = {
 var ADAPTERS = /* @__PURE__ */ new Map([
   [gmailSend.id, gmailSend],
   [gmailRead.id, gmailRead],
-  ["gmail.reply", replyAdapter("gmail.reply", "+reply")],
-  ["gmail.reply-all", replyAdapter("gmail.reply-all", "+reply-all")],
+  ["gmail.reply", replyAdapter("gmail.reply", "+reply", false)],
+  ["gmail.reply-all", replyAdapter("gmail.reply-all", "+reply-all", true)],
   [gmailForward.id, gmailForward],
   [gmailTriage.id, gmailTriage],
   [calendarAgenda.id, calendarAgenda],
@@ -7318,9 +7350,9 @@ function commitTool(category) {
 function words(query) {
   return (query ?? "").toLowerCase().split(/\s+/).filter(Boolean);
 }
-function startsWord(text3, token) {
-  for (let index2 = text3.indexOf(token); index2 !== -1; index2 = text3.indexOf(token, index2 + 1)) {
-    if (index2 === 0 || !/[a-z0-9]/.test(text3[index2 - 1])) return true;
+function startsWord(text4, token) {
+  for (let index2 = text4.indexOf(token); index2 !== -1; index2 = text4.indexOf(token, index2 + 1)) {
+    if (index2 === 0 || !/[a-z0-9]/.test(text4[index2 - 1])) return true;
   }
   return false;
 }
@@ -7634,12 +7666,14 @@ function defaultAccounts() {
   return { default: { mode: "interactive", enabledServices: services, access: "write" } };
 }
 var enabledServices = array(string2().min(1)).min(1);
+var domains = array(string2().regex(/^[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+$/u, "must be a domain such as example.com")).min(1);
 var accountProfile = preprocess(
   (value) => value !== null && typeof value === "object" && !Array.isArray(value) && !("mode" in value) ? { ...value, mode: "interactive" } : value,
   discriminatedUnion("mode", [
     strictObject({
       mode: literal("interactive"),
       enabledServices,
+      domains: domains.optional(),
       access: union([accessLevel, record(string2().min(1), accessLevel)]).optional(),
       scopes: array(string2().min(1)).optional(),
       oauthClient: OAuthClientSchema.optional()
@@ -7647,11 +7681,13 @@ var accountProfile = preprocess(
     strictObject({
       mode: literal("credentials_file"),
       enabledServices,
+      domains: domains.optional(),
       credentialsFileEnv: envVarName
     }),
     strictObject({
       mode: literal("access_token"),
       enabledServices,
+      domains: domains.optional(),
       tokenEnv: envVarName
     })
   ])
@@ -7775,6 +7811,7 @@ function loadConfig(raw) {
     accounts[alias] = {
       mode: profile.mode,
       enabledServices: enabled,
+      ...profile.domains ? { domains: [...new Set(profile.domains.map((domain) => domain.toLowerCase()))] } : {},
       access,
       ...accessSpecified ? { accessSpecified } : {},
       scopes: [...new Set(scopes)],
@@ -7841,10 +7878,9 @@ function loadConfig(raw) {
   };
 }
 
-// src/domain/version.ts
-var PLUGIN_VERSION = "0.0.2";
-var PLUGIN_ID = "google-workspace.gws";
+// src/domain/host.ts
 var HOST_RANGE = ">=2.2.3 <2.3.0";
+var TESTED_HOSTS = ["2.2.3", "2.2.4", "2.2.5"];
 var SEMVER = /^v?(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/;
 var RANGE = /^>=(\d+)\.(\d+)\.(\d+) <(\d+)\.(\d+)\.(\d+)$/;
 function compare(a, b) {
@@ -7863,18 +7899,20 @@ function satisfies(version2, range) {
   return compare(triple, floor) >= 0 && compare(triple, ceiling) < 0;
 }
 function checkHost(version2, range, allowUntested) {
-  const text3 = typeof version2 === "string" && version2.trim() ? version2.trim() : "unknown";
-  if (satisfies(text3, range)) return { version: text3 };
-  const problem = `tested with OpenCode ${range}, found ${text3}`;
-  if (!allowUntested) {
+  const text4 = typeof version2 === "string" && version2.trim() ? version2.trim() : void 0;
+  if (!(text4 && satisfies(text4, range)) && !allowUntested) {
     const [major, minor, patch] = bounds(range).floor;
     throw new Error(
-      `HOST_UNTESTED: Tested with OpenCode ${range}, found ${text3}. Next step: Use OpenCode ${major}.${minor}.${patch} or a later ${major}.${minor}.x release, or set "allowUntestedHost": true.`
+      `HOST_UNTESTED: Supports OpenCode ${range}, found ${text4 ?? "unknown"}. Next step: Use OpenCode ${major}.${minor}.${patch} or a later ${major}.${minor}.x release, or set "allowUntestedHost": true.`
     );
   }
-  return { version: text3, warning: `${problem}; running anyway because allowUntestedHost is true` };
+  return { version: text4 ?? null, range, tested: text4 !== void 0 && TESTED_HOSTS.includes(text4.replace(/^v/, "")) };
 }
 
+// src/domain/version.ts
+var PLUGIN_VERSION = "0.0.4";
+var PLUGIN_ID = "google-workspace.gws";
+
 // src/host/agents.ts
 var ASK_ACTIONS = ["gws.write", "gws.export", "gws.send", "gws.share", "gws.delete", "gws.admin"];
 var ASK_RULES = ASK_ACTIONS.map((action) => ({ action, resource: "*", effect: "ask" }));
@@ -7950,6 +7988,7 @@ var object2 = (properties, required2) => ({ type: "object", properties, required
 var MODES = ["interactive", "credentials_file", "access_token"];
 var ACCESS = ["read", "write"];
 var CLIENT_SOURCES = ["account", "plugin", "pasted"];
+var STATES = ["connected", "sign_in_required", "not_configured", "host_untested"];
 var account = object2(
   {
     alias: text,
@@ -7969,9 +8008,9 @@ var account = object2(
 );
 var status = object2(
   {
-    pluginVersion: text,
-    hostVersion: text,
-    hostWarning: text,
+    version: text,
+    host: object2({ version: { type: ["string", "null"] }, range: text, tested: { type: "boolean" } }, ["version", "range", "tested"]),
+    state: { enum: STATES },
     gws: object2({ path: text, version: text }, ["path", "version"]),
     services: texts,
     accounts: { type: "array", items: account },
@@ -7980,7 +8019,7 @@ var status = object2(
     permissionsBlock: text,
     nextStep: text
   },
-  ["pluginVersion", "hostVersion", "gws", "services", "accounts", "unguardedAgents"]
+  ["version", "host", "state", "gws", "services", "accounts", "unguardedAgents", "nextStep"]
 );
 var Gws = Rpc.define({
   id: RPC_ID,
@@ -7998,7 +8037,8 @@ function connectionLabel(account2) {
   return account2.mode === "interactive" ? "sign-in required" : "not configured";
 }
 function openCodeLabel(status2) {
-  return status2.hostWarning ? `${status2.hostVersion} (host untested: ${status2.hostWarning})` : `${status2.hostVersion} (tested)`;
+  const version2 = status2.host.version ?? "unknown";
+  return status2.host.tested ? `${version2} (tested)` : `${version2} (host untested; supported range ${status2.host.range})`;
 }
 var DELEGATION_LABEL = "Needs domain-wide delegation";
 function delegationText(account2) {
@@ -8100,10 +8140,11 @@ var Lifecycle = class {
 // src/domain/plans.ts
 import { randomBytes } from "node:crypto";
 var MAX_PLANS = 512;
-function redactedPreview(plan) {
-  const { method, recipients, destination, bodySummary, reason } = plan.preview;
+function redactedPreview(plan2) {
+  const { method, recipients, recipientsUnknown, destination, bodySummary, reason } = plan2.preview;
   const view = { method };
   if (recipients && recipients.length > 0) view.recipients = [...recipients];
+  if (recipientsUnknown !== void 0) view.recipientsUnknown = recipientsUnknown;
   if (destination !== void 0) view.destination = destination;
   if (bodySummary !== void 0) view.bodySummary = bodySummary;
   if (reason !== void 0) view.reason = reason;
@@ -8115,14 +8156,14 @@ var PlanStore = class {
     this.sweep();
     const now = Date.now();
     const { ttlSeconds, ...fields } = input;
-    const plan = {
+    const plan2 = {
       ...fields,
       id: `plan_${randomBytes(18).toString("base64url")}`,
       state: "ready",
       createdAt: now,
       expiresAt: now + ttlSeconds * 1e3
     };
-    this.plans.set(plan.id, plan);
+    this.plans.set(plan2.id, plan2);
     while (this.plans.size > MAX_PLANS) {
       const oldest = this.plans.keys().next().value;
       if (oldest === void 0) break;
@@ -8130,71 +8171,70 @@ var PlanStore = class {
       if (evicted) this.expire(evicted);
       this.plans.delete(oldest);
     }
-    return plan;
+    return plan2;
   }
   get(id) {
-    const plan = this.plans.get(id);
-    if (!plan) return void 0;
-    if (plan.state === "ready" && Date.now() >= plan.expiresAt) this.expire(plan);
-    return plan;
+    const plan2 = this.plans.get(id);
+    if (!plan2) return void 0;
+    if (plan2.state === "ready" && Date.now() >= plan2.expiresAt) this.expire(plan2);
+    return plan2;
   }
   /** Ready (committable) plans, oldest first, optionally for one session. */
   list(filter = {}) {
     const ready = [];
     for (const id of [...this.plans.keys()]) {
-      const plan = this.get(id);
-      if (plan?.state !== "ready") continue;
-      if (filter.sessionId !== void 0 && plan.sessionId !== filter.sessionId) continue;
-      ready.push(plan);
+      const plan2 = this.get(id);
+      if (plan2?.state !== "ready") continue;
+      if (filter.sessionId !== void 0 && plan2.sessionId !== filter.sessionId) continue;
+      ready.push(plan2);
     }
     return ready.sort((a, b) => a.createdAt - b.createdAt);
   }
   /** Validate a commit binding without consuming the plan. */
   check(id, binding) {
-    const plan = this.get(id);
-    if (!plan) throw new GwsError("PLAN_NOT_FOUND", "run gws_plan first");
-    if (plan.state === "consumed") throw new GwsError("PLAN_ALREADY_USED", "create a new plan");
-    if (plan.state === "expired" || Date.now() >= plan.expiresAt) throw new GwsError("PLAN_EXPIRED", "create a new plan");
-    if (plan.state === "committing") throw new GwsError("PLAN_ALREADY_USED", "plan is committing", { next: "Wait for the running commit to finish; do not commit this plan again." });
-    if (plan.sessionId !== binding.sessionId || plan.agentId !== binding.agentId) {
+    const plan2 = this.get(id);
+    if (!plan2) throw new GwsError("PLAN_NOT_FOUND", "run gws_plan first");
+    if (plan2.state === "consumed") {
+      throw new GwsError("PLAN_ALREADY_USED", "this plan was already committed", { next: "Create a new plan to repeat the change; check the earlier result with gws_read first." });
+    }
+    if (plan2.state === "expired" || Date.now() >= plan2.expiresAt) throw new GwsError("PLAN_EXPIRED", "create a new plan");
+    if (plan2.state === "committing") throw new GwsError("PLAN_ALREADY_USED", "plan is committing", { next: "Wait for the running commit to finish; do not commit this plan again." });
+    if (plan2.sessionId !== binding.sessionId || plan2.agentId !== binding.agentId) {
       throw new GwsError("PLAN_CALLER_MISMATCH", "a plan is bound to the session and agent that created it");
     }
-    if (plan.category !== binding.category) {
+    if (plan2.category !== binding.category) {
       throw new GwsError("CATEGORY_MISMATCH", "use the commit tool that matches the plan category", { next: "Commit with the tool named by the plan's category, passing only {planId}." });
     }
-    return plan;
+    return plan2;
   }
   acquire(id, binding) {
-    const plan = this.check(id, binding);
-    if (plan.account !== binding.account) {
+    const plan2 = this.check(id, binding);
+    if (plan2.account !== binding.account) {
       throw new GwsError("PLAN_CALLER_MISMATCH", "a plan is bound to the account that created it");
     }
-    plan.state = "committing";
-    return plan;
+    plan2.state = "committing";
+    return plan2;
   }
   complete(id) {
-    const plan = this.plans.get(id);
-    if (plan?.state !== "committing") return;
-    plan.state = "consumed";
+    const plan2 = this.plans.get(id);
+    if (plan2?.state !== "committing") return;
+    plan2.state = "consumed";
   }
   release(id) {
-    const plan = this.plans.get(id);
-    if (plan && plan.state === "committing") this.expire(plan);
+    const plan2 = this.plans.get(id);
+    if (plan2 && plan2.state === "committing") this.expire(plan2);
   }
   invalidateAll() {
-    for (const plan of this.plans.values()) this.expire(plan);
+    for (const plan2 of this.plans.values()) this.expire(plan2);
   }
-  expire(plan) {
-    if (plan.state !== "ready" && plan.state !== "committing") return;
-    plan.state = "expired";
+  expire(plan2) {
+    if (plan2.state !== "ready" && plan2.state !== "committing") return;
+    plan2.state = "expired";
   }
   sweep() {
     const now = Date.now();
-    for (const [id, plan] of this.plans) {
-      if (plan.state === "ready" && now >= plan.expiresAt) this.expire(plan);
-      if (plan.state === "consumed" || plan.state === "expired" || now >= plan.expiresAt) {
-        this.plans.delete(id);
-      }
+    for (const [id, plan2] of this.plans) {
+      if (now >= plan2.expiresAt && plan2.state !== "committing") this.plans.delete(id);
     }
   }
 };
@@ -8203,11 +8243,11 @@ var PlanStore = class {
 function isApiError(value) {
   if (Array.isArray(value)) return value.some(isApiError);
   if (!value || typeof value !== "object") return false;
-  const record2 = value;
-  return "error" in record2 && record2.error !== null && typeof record2.error === "object";
+  const record3 = value;
+  return "error" in record3 && record3.error !== null && typeof record3.error === "object";
 }
-function parseJson(text3) {
-  const lines = text3.split("\n");
+function parseJson(text4) {
+  const lines = text4.split("\n");
   const start2 = lines.findIndex((line) => /^[[{]/.test(line.trim()));
   if (start2 < 0) return void 0;
   const candidate = lines.slice(start2).join("\n").trim();
@@ -8231,28 +8271,42 @@ function inlineCap(maxInlineBytes, mode, requested) {
   return requested === void 0 ? base2 : Math.min(base2, requested);
 }
 function parseResult(result, options) {
-  const text3 = result.stdout.toString("utf8");
-  const parsed = parseJson(text3);
-  const serialized = parsed === void 0 ? text3 : JSON.stringify(parsed);
+  const text4 = result.stdout.toString("utf8");
+  const parsed = parseJson(text4);
+  const serialized = parsed === void 0 ? text4 : JSON.stringify(parsed);
   const bytes2 = Buffer.byteLength(serialized);
   const cap = inlineCap(options.maxInlineBytes, options.mode, options.requestedInlineBytes);
   const truncated = bytes2 > cap;
-  const empty = text3.trim().length === 0;
+  const empty = text4.trim().length === 0;
   return {
     // A successful DELETE commonly returns 204 with no body. Empty output
     // with exit 0 is success; non-JSON text is not a JSON result.
     ok: result.exitCode === 0 && (empty || parsed !== void 0 && !isApiError(parsed)),
     data: parsed,
-    raw: parsed === void 0 ? text3.slice(0, cap) : void 0,
+    raw: parsed === void 0 ? text4.slice(0, cap) : void 0,
     truncated,
     diagnostics: { exitCode: result.exitCode, durationMs: result.durationMs, bytes: bytes2 }
   };
 }
+function withoutSavedBody(data, next) {
+  if (!data || typeof data !== "object" || Array.isArray(data)) return data;
+  const record3 = data;
+  const keys = Object.keys(record3);
+  if (typeof record3["saved_file"] !== "string" || typeof record3["bytes"] !== "number" || record3["status"] !== "success") return data;
+  if (!keys.every((key) => ["bytes", "mimeType", "saved_file", "status"].includes(key))) return data;
+  if (record3["bytes"] === 0) return "";
+  return {
+    ...typeof record3["mimeType"] === "string" ? { mimeType: record3["mimeType"] } : {},
+    bytes: record3["bytes"],
+    saved: false,
+    ...next ? { next } : {}
+  };
+}
 function itemKey(page2) {
   if (!page2 || typeof page2 !== "object" || Array.isArray(page2)) return void 0;
-  const record2 = page2;
-  if (Array.isArray(record2["items"])) return "items";
-  const arrays = Object.keys(record2).filter((key) => Array.isArray(record2[key]));
+  const record3 = page2;
+  if (Array.isArray(record3["items"])) return "items";
+  const arrays = Object.keys(record3).filter((key) => Array.isArray(record3[key]));
   return arrays.length === 1 ? arrays[0] : void 0;
 }
 function capPageItems(data, maxItems) {
@@ -8272,11 +8326,11 @@ function capPageItems(data, maxItems) {
       kept.push(page2);
       continue;
     }
-    const record2 = page2;
-    const list = record2[key];
+    const record3 = page2;
+    const list = record3[key];
     const room = maxItems - items;
     if (list.length > room) {
-      const { nextPageToken: _dropped, ...rest } = record2;
+      const { nextPageToken: _dropped, ...rest } = record3;
       kept.push({ ...rest, [key]: list.slice(0, room) });
       items += room;
       capped = true;
@@ -8315,29 +8369,33 @@ function stderrText(result) {
 var EXIT = { auth: 2, validation: 3, discovery: 4, internal: 5 };
 var SCOPE_REASONS = /* @__PURE__ */ new Set(["ACCESS_TOKEN_SCOPE_INSUFFICIENT", "insufficientPermissions"]);
 var PRIVILEGE_REFUSALS = /\bnot authori[sz]ed to (?:read|access|view|list|use|manage|perform)\b|\bcaller does not have access to the customers? reporting data\b/i;
-function privilegeRefused(result, parsed) {
+function privilegeRefused(result, service, parsed) {
+  if (!isAdminService(service)) return false;
   if (result.timedOut || result.outputCapped || result.exitCode === 0 || result.exitCode === EXIT.auth) return false;
   const error2 = apiErrorOf(result, parsed);
   if (error2?.code !== void 0 && error2.code !== 401 && error2.code !== 403) return false;
-  const text3 = [error2?.message, stderrText(result)].filter(Boolean).join("\n");
-  return !/invalid_grant/i.test(text3) && PRIVILEGE_REFUSALS.test(text3);
+  const text4 = [error2?.message, stderrText(result)].filter(Boolean).join("\n");
+  return !/invalid_grant/i.test(text4) && PRIVILEGE_REFUSALS.test(text4);
+}
+function isAdminService(service) {
+  return service.startsWith("admin-");
 }
 var ADMIN_PRIVILEGES = { "admin-reports": "Reports" };
 function privilegeName(service) {
   const name = service ? ADMIN_PRIVILEGES[service] : void 0;
   return name ? `the ${name} privilege` : "the admin privilege it needs";
 }
-function authProblem(result, parsed) {
+function authProblem(result, service, parsed) {
   if (result.timedOut || result.outputCapped) return void 0;
-  if (privilegeRefused(result, parsed)) return void 0;
+  if (privilegeRefused(result, service, parsed)) return void 0;
   const error2 = apiErrorOf(result, parsed);
   if (result.exitCode === 0 && !error2) return void 0;
   const reasons = [error2?.reason, ...(error2?.errors ?? []).map((item) => item?.reason), ...(error2?.details ?? []).map((item) => item?.reason)];
-  const text3 = [error2?.message, error2?.status, stderrText(result)].filter(Boolean).join("\n");
-  if (reasons.some((reason) => reason !== void 0 && SCOPE_REASONS.has(reason)) || /insufficient authentication scopes|ACCESS_TOKEN_SCOPE_INSUFFICIENT/i.test(text3)) {
+  const text4 = [error2?.message, error2?.status, stderrText(result)].filter(Boolean).join("\n");
+  if (reasons.some((reason) => reason !== void 0 && SCOPE_REASONS.has(reason)) || /insufficient authentication scopes|ACCESS_TOKEN_SCOPE_INSUFFICIENT/i.test(text4)) {
     return "AUTH_SCOPE_MISSING";
   }
-  if (error2?.code === 401 || error2?.status === "UNAUTHENTICATED" || reasons.includes("authError") || /invalid_grant|\bUNAUTHENTICATED\b|^error\[auth\]/im.test(text3)) {
+  if (error2?.code === 401 || error2?.status === "UNAUTHENTICATED" || reasons.includes("authError") || /invalid_grant|\bUNAUTHENTICATED\b|^error\[auth\]/im.test(text4)) {
     return "AUTH_REQUIRED";
   }
   return void 0;
@@ -8352,28 +8410,28 @@ var CONSOLE_URL = /https:\/\/console\.(?:developers|cloud)\.google\.com\/[^\s"'<
 function disabledApi(result, parsed) {
   const error2 = apiErrorOf(result, parsed);
   const reasons = [error2?.reason, ...(error2?.errors ?? []).map((item) => item?.reason), ...(error2?.details ?? []).map((item) => item?.reason)];
-  const text3 = [error2?.message, stderrText(result)].filter(Boolean).join("\n");
-  if (!reasons.some((reason) => reason !== void 0 && DISABLED_REASONS.has(reason)) && !/accessnotconfigured|has not been used|is disabled/i.test(text3)) {
+  const text4 = [error2?.message, stderrText(result)].filter(Boolean).join("\n");
+  if (!reasons.some((reason) => reason !== void 0 && DISABLED_REASONS.has(reason)) && !/accessnotconfigured|has not been used|is disabled/i.test(text4)) {
     return void 0;
   }
-  const enableUrl = (typeof error2?.enable_url === "string" && CONSOLE_URL.test(error2.enable_url) ? error2.enable_url : CONSOLE_URL.exec(text3)?.[0])?.replace(/[.,;]+$/, "");
-  const project = (enableUrl ? /[?&]project=([\w.:-]+)/.exec(enableUrl)?.[1] : void 0) ?? /\bin project ([\w.:-]+)/.exec(text3)?.[1];
+  const enableUrl = (typeof error2?.enable_url === "string" && CONSOLE_URL.test(error2.enable_url) ? error2.enable_url : CONSOLE_URL.exec(text4)?.[0])?.replace(/[.,;]+$/, "");
+  const project = (enableUrl ? /[?&]project=([\w.:-]+)/.exec(enableUrl)?.[1] : void 0) ?? /\bin project ([\w.:-]+)/.exec(text4)?.[1];
   return { ...enableUrl ? { enableUrl } : {}, ...project ? { project } : {} };
 }
-function processError(result, parsed, remediation = GENERIC_REMEDIATION) {
+function processError(result, parsed, service, remediation = GENERIC_REMEDIATION) {
   if (result.timedOut) return new GwsError("TIMEOUT", `gws did not finish within the configured execution.timeoutMs (${result.durationMs}ms elapsed)`);
   if (result.outputCapped) return new GwsError("OUTPUT_LIMIT", "gws output exceeded execution.maxStdoutBytes/maxStderrBytes; narrow fields or pagination");
   const stderr = stderrText(result);
   const payload = apiErrorOf(result, parsed);
   const message = payload?.message || stderr || "gws command failed";
-  if (privilegeRefused(result, parsed)) {
+  if (privilegeRefused(result, service, parsed)) {
     return new GwsError(
       "ADMIN_PRIVILEGE_REQUIRED",
       `Google accepted the sign-in but refused the call, because the account lacks a Workspace admin privilege; signing in again as the same account cannot help (gws: ${message.slice(0, 300)})`,
       { next: `${remediation.privilege.charAt(0).toUpperCase()}${remediation.privilege.slice(1)}.` }
     );
   }
-  const problem = authProblem(result, parsed) ?? (result.exitCode === EXIT.auth ? "AUTH_REQUIRED" : void 0);
+  const problem = authProblem(result, service, parsed) ?? (result.exitCode === EXIT.auth ? "AUTH_REQUIRED" : void 0);
   if (problem === "AUTH_SCOPE_MISSING") {
     return new GwsError("AUTH_SCOPE_MISSING", `the credential lacks a scope for this operation; ${remediation.consent} (gws: ${message.slice(0, 300)})`);
   }
@@ -8397,16 +8455,16 @@ var COMMANDS = {
   status: { name: "gws-status", description: "Google Workspace: sign-in, access, pending plans, setup steps, and unguarded agents" },
   doctor: { name: "gws-doctor", description: "Google Workspace: check every account's services with one small read each" }
 };
-function planSummary(plan) {
+function planSummary(plan2) {
   return {
-    planId: plan.id,
-    sessionID: plan.sessionId,
-    category: plan.category,
-    operation: plan.operation,
-    account: plan.account,
-    preview: redactedPreview(plan),
-    createdAt: new Date(plan.createdAt).toISOString(),
-    expiresAt: new Date(plan.expiresAt).toISOString()
+    planId: plan2.id,
+    sessionID: plan2.sessionId,
+    category: plan2.category,
+    operation: plan2.operation,
+    account: plan2.account,
+    preview: redactedPreview(plan2),
+    createdAt: new Date(plan2.createdAt).toISOString(),
+    expiresAt: new Date(plan2.expiresAt).toISOString()
   };
 }
 function summarizeStatus(status2, plans = []) {
@@ -8465,7 +8523,7 @@ function formatStatus(status2, plans = [], now = Date.now()) {
     lines.push(`Agents without default rules: ${status2.unguardedAgents.join(", ")}`, status2.permissionsBlock ?? "", BLOCK_PLACEMENT);
   }
   if (status2.auditDegraded) lines.push("Audit: some records could not be saved, so the audit log may be incomplete.");
-  lines.push(`OpenCode: ${openCodeLabel(status2)}`, `Next step: ${status2.nextStep ?? NOTHING_TO_DO}`);
+  lines.push(`OpenCode: ${openCodeLabel(status2)}`, `Next step: ${status2.nextStep}`);
   return lines.join("\n");
 }
 function planLines(plans, now) {
@@ -8474,14 +8532,15 @@ function planLines(plans, now) {
     lines.push("No pending plans in this session.");
   } else {
     lines.push(`Pending plans in this session (${plans.length}):`);
-    for (const plan of plans) {
+    for (const plan2 of plans) {
       const details = [
-        plan.preview.recipients?.length ? `to ${plan.preview.recipients.join(", ")}` : void 0,
-        plan.preview.destination ? `destination ${plan.preview.destination}` : void 0,
-        plan.preview.bodySummary ? `body ${plan.preview.bodySummary}` : void 0,
-        `expires ${remaining(plan.expiresAt, now)}`
+        plan2.preview.recipients?.length ? `to ${plan2.preview.recipients.join(", ")}` : void 0,
+        plan2.preview.recipientsUnknown ? `recipients unknown: ${plan2.preview.recipientsUnknown}` : void 0,
+        plan2.preview.destination ? `destination ${plan2.preview.destination}` : void 0,
+        plan2.preview.bodySummary ? `body ${plan2.preview.bodySummary}` : void 0,
+        `expires ${remaining(plan2.expiresAt, now)}`
       ].filter(Boolean);
-      lines.push(`- ${plan.category} ${plan.operation} as ${plan.account}: ${details.join(" \xB7 ")} (${plan.planId})`);
+      lines.push(`- ${plan2.category} ${plan2.operation} as ${plan2.account}: ${details.join(" \xB7 ")} (${plan2.planId})`);
     }
     lines.push("Approval happens only in the OpenCode permission prompt when the agent commits a plan. Pending plans expire automatically.");
   }
@@ -8530,8 +8589,8 @@ function formatDoctor(outcomes) {
   if (outcomes.length === 0) lines.push("No account enables a service.");
   for (const outcome of outcomes) {
     const next = nextFor(outcome);
-    const text3 = [outcome.detail, next ? `Next step: ${next.charAt(0).toUpperCase()}${next.slice(1)}` : void 0].filter(Boolean).join(". ");
-    lines.push(`- ${outcome.account} ${outcome.service}: ${outcome.status}${text3 ? ` \xB7 ${text3}` : ""}`);
+    const text4 = [outcome.detail, next ? `Next step: ${next.charAt(0).toUpperCase()}${next.slice(1)}` : void 0].filter(Boolean).join(". ");
+    lines.push(`- ${outcome.account} ${outcome.service}: ${outcome.status}${text4 ? ` \xB7 ${text4}` : ""}`);
   }
   return lines.join("\n");
 }
@@ -8542,9 +8601,9 @@ function summarizeDoctor(outcomes) {
 }
 async function registerCommands(ctx, sources, signal) {
   const lifetime = new Lifecycle();
-  const post = (sessionID, delivery, text3, description, command) => lifetime.wait(() => ctx.session.synthetic({
+  const post = (sessionID, delivery, text4, description, command) => lifetime.wait(() => ctx.session.synthetic({
     sessionID,
-    text: text3,
+    text: text4,
     description,
     metadata: { source: "opencode-gws", command },
     delivery,
@@ -8896,8 +8955,8 @@ function tokenError(status2, json, secrets) {
   message = scrubSecrets(message, secrets);
   return new Error(message);
 }
-function scrubSecrets(text3, secrets) {
-  let out = text3;
+function scrubSecrets(text4, secrets) {
+  let out = text4;
   for (const secret of secrets) {
     if (secret) out = out.split(secret).join("[redacted]");
   }
@@ -8919,15 +8978,15 @@ async function postToken(endpoint, body, fetchImpl, secrets) {
   } catch {
     throw new Error("Google token request failed: could not reach the token endpoint.");
   }
-  let text3 = "";
+  let text4 = "";
   try {
-    text3 = await response.text();
+    text4 = await response.text();
   } catch {
   }
   let json = {};
-  if (text3.trim()) {
+  if (text4.trim()) {
     try {
-      const parsed = JSON.parse(text3);
+      const parsed = JSON.parse(text4);
       if (isRecord(parsed)) json = parsed;
     } catch {
       if (response.ok) throw new Error("Google token endpoint returned an invalid response.");
@@ -9387,22 +9446,27 @@ function nextStep(accounts, agents) {
   if (agents.length > 0) return "Put the permission block first in the own permissions of each agent without default rules, followed by your top-level rules for gws actions.";
   return void 0;
 }
+function stateOf(accounts, tested) {
+  if (accounts.some((account2) => account2.needsAuth || !account2.connected && account2.mode === "interactive")) return "sign_in_required";
+  if (accounts.some((account2) => !account2.connected)) return "not_configured";
+  return tested ? "connected" : "host_untested";
+}
 function statusSource(runtime, listAgents) {
   return async (signal) => {
     const base2 = await runtime.status(signal);
     const agents = unguardedAgents(await runtime.wait(() => listAgents(), signal));
     const next = nextStep(base2.accounts, agents);
     return {
-      pluginVersion: base2.pluginVersion,
-      hostVersion: base2.hostVersion,
-      ...base2.hostWarning ? { hostWarning: base2.hostWarning } : {},
+      version: base2.version,
+      host: base2.host,
+      state: stateOf(base2.accounts, base2.host.tested),
       gws: { path: base2.binary.path, version: base2.binary.version },
       services: base2.services,
       accounts: base2.accounts,
       auditDegraded: base2.auditDegraded,
       unguardedAgents: agents,
       ...agents.length > 0 ? { permissionsBlock: permissionsBlock(agents) } : {},
-      ...next ? { nextStep: next } : {}
+      nextStep: next ?? NOTHING_TO_DO
     };
   };
 }
@@ -9447,25 +9511,25 @@ function operationRequest(call2, action, target) {
     metadata: compact({ ...mark(call2), account: target.account, operation: target.operation, service: target.service, category: target.category })
   };
 }
-function planMetadata(plan) {
+function planMetadata(plan2) {
   return compact({
-    planId: plan.id,
-    category: plan.category,
-    operation: plan.operation,
-    account: plan.account,
-    ...redactedPreview(plan),
-    expiresAt: new Date(plan.expiresAt).toISOString()
+    planId: plan2.id,
+    category: plan2.category,
+    operation: plan2.operation,
+    account: plan2.account,
+    ...redactedPreview(plan2),
+    expiresAt: new Date(plan2.expiresAt).toISOString()
   });
 }
 var SAVABLE = /* @__PURE__ */ new Set(["write", "export"]);
-function commitRequests(call2, action, plan) {
-  const id = resource(plan.account, plan.operation);
-  const request = { ...base(call2, action), resources: [id], metadata: planMetadata(plan) };
-  if (SAVABLE.has(plan.category)) request.save = [id];
+function commitRequests(call2, action, plan2) {
+  const id = resource(plan2.account, plan2.operation);
+  const request = { ...base(call2, action), resources: [id], metadata: planMetadata(plan2) };
+  if (SAVABLE.has(plan2.category)) request.save = [id];
   return [request];
 }
-function compact(record2) {
-  return Object.fromEntries(Object.entries(record2).filter(([, value]) => value !== void 0));
+function compact(record3) {
+  return Object.fromEntries(Object.entries(record3).filter(([, value]) => value !== void 0));
 }
 
 // src/host/tools.ts
@@ -9608,7 +9672,8 @@ var Preview = object({
   url: string2().nullable().optional(),
   params: JsonObject.describe("Parameters with secret-like values redacted"),
   bodySummary: string2().optional().describe("Body keys and size; never the body"),
-  recipients: array(string2()).optional(),
+  recipients: array(string2()).optional().describe("Every address a send or share reaches, including those read for a reply, a draft or an event; *@domain for a whole domain"),
+  recipientsUnknown: string2().optional().describe("Why the plugin could not tell everyone this send or share reaches"),
   uploads: array(string2()).optional().describe("Local files the commit uploads or attaches"),
   destination: string2().optional().describe("Local file the export writes"),
   overwrite: boolean2().optional().describe("The export replaces an existing file at destination"),
@@ -9649,17 +9714,23 @@ var AccountStatus = object({
   delegationRequired: array(string2()).optional().describe("Enabled services that need domain-wide delegation, which a Workspace admin sets up; the sign-in requests none of their scopes unless accounts.<alias>.scopes adds them"),
   nextStep: string2().optional().describe("What to do next; absent when nothing is needed")
 });
+var Host = object({
+  version: string2().nullable().describe("The OpenCode version; null when unknown"),
+  range: string2().describe("The supported range, as in package.json opencode.host"),
+  tested: boolean2().describe("True only for a release the plugin is tested on")
+});
+var STATES2 = ["connected", "sign_in_required", "not_configured", "host_untested"];
 var StatusOutput = object({
-  pluginVersion: string2(),
-  hostVersion: string2(),
-  hostWarning: string2().optional().describe("Present when the OpenCode host is outside the tested range and allowUntestedHost is set"),
+  version: string2().describe("The plugin's version"),
+  host: Host,
+  state: _enum(STATES2).describe("connected; sign_in_required or not_configured when an account needs it; host_untested on an untested OpenCode"),
   gws: object({ path: string2(), version: string2() }),
   services: array(string2()).describe("Model-facing services"),
   accounts: array(AccountStatus),
   auditDegraded: boolean2().describe("Audit records were dropped, failed, or exceeded the sink deadline; sticky until reload"),
   unguardedAgents: number2().int().describe("How many agents missed the default ask rules"),
   permissions: string2().optional().describe("Present when an agent missed the ask rules: where to find the fix"),
-  nextStep: string2().optional().describe("The one thing to do next; absent when nothing is needed")
+  nextStep: string2().describe('The one thing to do next; "Nothing to do." when nothing is needed')
 });
 
 // src/host/tools.ts
@@ -9763,6 +9834,7 @@ function toolSpecs(runtime, assert2, status2) {
         report(call2, input.operation);
         const target = runtime.inspect(input, "plan");
         await authorize(call2, operationRequest(call2.host, "gws.plan", target));
+        for (const operation of target.reads ?? []) await authorize(call2, operationRequest(call2.host, "gws.read", { ...target, operation, category: "read" }));
         const output = await runtime.plan(input, call2.runtime);
         return { output, metadata: { operation: target.operation, category: output.category, account: target.account } };
       }
@@ -9776,11 +9848,11 @@ function toolSpecs(runtime, assert2, status2) {
         input: CommitInput,
         output: CommitOutput,
         run: async (input, call2) => {
-          const plan = runtime.inspectPlan(category, input, call2.runtime);
-          report(call2, plan.operation);
-          for (const request of commitRequests(call2.host, `gws.${category}`, plan)) await authorize(call2, request);
+          const plan2 = runtime.inspectPlan(category, input, call2.runtime);
+          report(call2, plan2.operation);
+          for (const request of commitRequests(call2.host, `gws.${category}`, plan2)) await authorize(call2, request);
           const output = await runtime.commit(category, input, call2.runtime);
-          return { output, metadata: { operation: plan.operation, category, account: plan.account } };
+          return { output, metadata: { operation: plan2.operation, category, account: plan2.account } };
         }
       })
     )
@@ -9857,28 +9929,51 @@ function report(call2, operation) {
   call2.runtime.progress?.({ status: "resolving", operation });
 }
 function render(output, maxBytes) {
-  const text3 = JSON.stringify(output) ?? "";
-  const bytes2 = Buffer.byteLength(text3);
-  if (bytes2 <= maxBytes) return { text: text3, truncated: false };
-  const cut = Buffer.from(text3).subarray(0, maxBytes).toString("utf8");
+  const text4 = JSON.stringify(output) ?? "";
+  const bytes2 = Buffer.byteLength(text4);
+  if (bytes2 <= maxBytes) return { text: text4, truncated: false };
+  const cut = Buffer.from(text4).subarray(0, maxBytes).toString("utf8");
   return {
     text: `${cut}
 \u2026[truncated: ${maxBytes} of ${bytes2} bytes shown; narrow fields, params or pagination to see the rest]`,
     truncated: true
   };
 }
-function compact2(record2) {
-  return Object.fromEntries(Object.entries(record2).filter(([, value]) => value !== void 0));
+function compact2(record3) {
+  return Object.fromEntries(Object.entries(record3).filter(([, value]) => value !== void 0));
 }
 
 // src/host/scripting.ts
 var TOOLS_RPC_ID = `${RPC_ID}.tools`;
 var COMMIT_TOOLS = /* @__PURE__ */ new Set(["write", "send", "share", "delete", "export", "admin"]);
 var UNATTENDED = "A script cannot answer an approval prompt; this needs an allow rule for the session's agent.";
-var Envelope = strictObject({
-  sessionID: string2().min(1),
-  input: unknown()
-});
+var ENVELOPE_MESSAGES = {
+  notObject: `the envelope must be an object, such as {"sessionID":"<session>","input":<the tool's input>}`,
+  unknownKey: (key) => `"${key}" is not allowed`,
+  sessionID: `"sessionID" must be a non-empty string`,
+  inputMissing: `"input" is missing`,
+  describe: "describe takes no input"
+};
+var plainObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function strict(schema, validate2) {
+  return Object.defineProperty({ ...schema }, "~standard", { value: { version: 1, vendor: "opencode-gws", validate: validate2 }, enumerable: false });
+}
+var ENVELOPE = strict(
+  { type: "object", properties: { sessionID: { type: "string", minLength: 1 }, input: {} }, required: ["sessionID", "input"], additionalProperties: false },
+  (value) => {
+    if (!plainObject(value)) return { issues: [{ message: ENVELOPE_MESSAGES.notObject }] };
+    const found = [
+      ...Object.keys(value).filter((key) => key !== "sessionID" && key !== "input").map(ENVELOPE_MESSAGES.unknownKey),
+      ...typeof value["sessionID"] === "string" && value["sessionID"] !== "" ? [] : [ENVELOPE_MESSAGES.sessionID],
+      ..."input" in value ? [] : [ENVELOPE_MESSAGES.inputMissing]
+    ];
+    return found.length === 0 ? { value } : { issues: found.map((message) => ({ message })) };
+  }
+);
+var DESCRIBE_INPUT = strict(
+  { type: "object", properties: {}, additionalProperties: false },
+  (value) => value === void 0 || value === null || plainObject(value) && Object.keys(value).length === 0 ? { value } : { issues: [{ message: ENVELOPE_MESSAGES.describe }] }
+);
 var Failure = strictObject({ code: string2(), next: string2() });
 var Description = strictObject({
   id: string2(),
@@ -9895,9 +9990,9 @@ var Description = strictObject({
 });
 function sessionNotFound(error2) {
   if (error2 === null || typeof error2 !== "object") return false;
-  const record2 = error2;
-  const tag = record2["_tag"] ?? record2["name"];
-  return tag === "Session.NotFoundError" || tag === "SessionNotFoundError" || record2["status"] === 404 || record2["statusCode"] === 404;
+  const record3 = error2;
+  const tag = record3["_tag"] ?? record3["name"];
+  return tag === "Session.NotFoundError" || tag === "SessionNotFoundError" || record3["status"] === 404 || record3["statusCode"] === 404;
 }
 async function registerScripting(ctx, runtime, status2) {
   const assert2 = async (request) => {
@@ -9937,8 +10032,8 @@ async function registerScripting(ctx, runtime, status2) {
   const contract = Rpc2.define({
     id: TOOLS_RPC_ID,
     methods: {
-      describe: { input: strictObject({}).optional(), output: Description },
-      ...Object.fromEntries(specs.map((spec2) => [spec2.name, { input: Envelope, output: spec2.output, errors: { failed: Failure } }]))
+      describe: { input: DESCRIBE_INPUT, output: Description },
+      ...Object.fromEntries(specs.map((spec2) => [spec2.name, { input: ENVELOPE, output: spec2.output, errors: { failed: Failure } }]))
     },
     events: {}
   });
@@ -10041,12 +10136,12 @@ async function registerSkills(ctx, config2, visibleServices) {
 }
 
 // src/runtime/index.ts
-import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
-import { join as join8 } from "node:path";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { join as join9 } from "node:path";
 
 // src/domain/audit.ts
-import { writeFile, mkdir } from "node:fs/promises";
+import { mkdir, rename, stat, writeFile } from "node:fs/promises";
 import { write } from "node:fs";
 import { dirname as dirname3 } from "node:path";
 var EVENTS = /* @__PURE__ */ new Set(["plugin.loaded", "operation.read", "helper.read", "operation.plan", "operation.commit"]);
@@ -10055,6 +10150,7 @@ var UNKNOWN_ERROR = "UNKNOWN_ERROR";
 function auditErrorCode(error2) {
   return GwsError.from(error2)?.code ?? UNKNOWN_ERROR;
 }
+var AUDIT_MAX_BYTES = 5 * 1024 * 1024;
 var MAX_QUEUE = 64;
 var WRITE_TIMEOUT_MS = 100;
 var Audit = class {
@@ -10065,6 +10161,9 @@ var Audit = class {
       if (this.config.sink === "jsonl" && this.config.path) {
         await mkdir(dirname3(this.config.path), { recursive: true, mode: 448 });
         if (signal.aborted) return;
+        const size = await stat(this.config.path).then((found) => found.size, () => 0);
+        if (size > 0 && size + Buffer.byteLength(line) > AUDIT_MAX_BYTES) await rename(this.config.path, `${this.config.path}.1`);
+        if (signal.aborted) return;
         await writeFile(this.config.path, line, { flag: "a", mode: 384, signal });
       } else {
         await writeStderr(line, signal);
@@ -10184,9 +10283,9 @@ function assertTrusted(path, projectDirectory) {
   if (!isAbsolute4(path)) throw new Error(`BINARY_TRUST_FAILED: Binary path must be absolute: ${path}`);
   if (!existsSync2(path)) throw new Error(`GWS_UNAVAILABLE: The binary.path option names a missing file: ${path}. Next step: S${OVERRIDE.slice(1)}.`);
   const real = realpathSync(path);
-  const stat2 = statSync(real);
-  if (!stat2.isFile()) throw new Error(`BINARY_TRUST_FAILED: Not a regular file: ${real}`);
-  if ((stat2.mode & 73) === 0 || (stat2.mode & 18) !== 0) {
+  const stat3 = statSync(real);
+  if (!stat3.isFile()) throw new Error(`BINARY_TRUST_FAILED: Not a regular file: ${real}`);
+  if ((stat3.mode & 73) === 0 || (stat3.mode & 18) !== 0) {
     throw new Error("BINARY_TRUST_FAILED: Binary must be executable and not group/world writable");
   }
   if (projectDirectory && isUnder(resolve(projectDirectory), real)) {
@@ -10197,13 +10296,13 @@ function assertTrusted(path, projectDirectory) {
   if (typeof process.getgroups === "function") for (const gid of process.getgroups()) groups.add(gid);
   let dir = dirname4(real);
   for (; ; ) {
-    const stat3 = statSync(dir);
-    const mode = stat3.mode & 511;
+    const stat4 = statSync(dir);
+    const mode = stat4.mode & 511;
     if ((mode & 2) !== 0) {
       throw new Error(`BINARY_TRUST_FAILED: World-writable ancestor: ${dir} (mode ${mode.toString(8)})`);
     }
-    if ((mode & 16) !== 0 && !groups.has(stat3.gid)) {
-      throw new Error(`BINARY_TRUST_FAILED: Group-writable ancestor owned by a foreign group: ${dir} (mode ${mode.toString(8)}, gid ${stat3.gid})`);
+    if ((mode & 16) !== 0 && !groups.has(stat4.gid)) {
+      throw new Error(`BINARY_TRUST_FAILED: Group-writable ancestor owned by a foreign group: ${dir} (mode ${mode.toString(8)}, gid ${stat4.gid})`);
     }
     const parent = dirname4(dir);
     if (parent === dir) break;
@@ -10241,12 +10340,12 @@ function resolvePackagedBinary(platform = currentPlatform(), from = new URL("./p
   }
   const path = join3(dirname4(realpathSync(manifest)), "bin", "gws");
   if (!existsSync2(path)) throw new Error(`GWS_UNAVAILABLE: ${name} has no bin/gws. Next step: Reinstall the plugin, or ${OVERRIDE}.`);
-  const stat2 = lstatSync(path);
-  const mode = stat2.mode & 4095;
-  if (!stat2.isFile() || realpathSync(path) !== path || (mode & 320) !== 320 || (mode & ~493) !== 0) {
+  const stat3 = lstatSync(path);
+  const mode = stat3.mode & 4095;
+  if (!stat3.isFile() || realpathSync(path) !== path || (mode & 320) !== 320 || (mode & ~493) !== 0) {
     throw new Error(`BINARY_TRUST_FAILED: ${name} bin/gws must be a regular file, not a link, with owner read/execute and no permissions outside 0755`);
   }
-  const identity = `${stat2.size}:${stat2.mtimeMs}:${stat2.ino}`;
+  const identity = `${stat3.size}:${stat3.mtimeMs}:${stat3.ino}`;
   if (admitted.get(path) === identity) return path;
   if (createHash2("sha256").update(readFileSync3(path)).digest("hex") !== GWS_TARGETS[target].sha256) {
     throw new Error(`BINARY_TRUST_FAILED: ${name} bin/gws does not match the pinned ${target} release of gws 0.22.5`);
@@ -10432,6 +10531,62 @@ function runProcess(options) {
   });
 }
 
+// src/process/workdir.ts
+import { lstatSync as lstatSync2, mkdtempSync, readdirSync, readFileSync as readFileSync4, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join6 } from "node:path";
+var PREFIX2 = "opencode-gws-";
+var OWNER = "owner.pid";
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var UNOWNED_MS = 7 * DAY_MS;
+function createWorkDir(root = tmpdir()) {
+  const dir = mkdtempSync(join6(root, PREFIX2));
+  writeFileSync(join6(dir, ".env"), "");
+  writeFileSync(join6(dir, OWNER), `${process.pid}
+`, { mode: 384 });
+  return dir;
+}
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error2) {
+    return error2.code === "EPERM";
+  }
+}
+function removeStaleWorkDirs(root = tmpdir(), now = Date.now()) {
+  const removed = [];
+  let names;
+  try {
+    names = readdirSync(root);
+  } catch {
+    return removed;
+  }
+  const uid = process.getuid?.();
+  for (const name of names) {
+    if (!/^opencode-gws-(?:probe-)?[A-Za-z0-9]{6}$/.test(name)) continue;
+    const dir = join6(root, name);
+    try {
+      const stat3 = lstatSync2(dir);
+      if (!stat3.isDirectory() || uid !== void 0 && stat3.uid !== uid) continue;
+      const age = now - stat3.mtimeMs;
+      if (age < DAY_MS) continue;
+      let owner;
+      try {
+        owner = Number.parseInt(readFileSync4(join6(dir, OWNER), "utf8"), 10);
+      } catch {
+        owner = void 0;
+      }
+      const stale = owner !== void 0 && Number.isInteger(owner) && owner > 0 ? !alive(owner) : age >= UNOWNED_MS;
+      if (!stale) continue;
+      rmSync(dir, { recursive: true, force: true });
+      removed.push(dir);
+    } catch {
+    }
+  }
+  return removed;
+}
+
 // src/domain/schema.ts
 function parseSchemaOutput(id, stdout, stderr) {
   const start2 = stdout.indexOf("{");
@@ -10486,15 +10641,16 @@ var SchemaClient = class {
 };
 
 // src/runtime/accounts.ts
-import { join as join6 } from "node:path";
+import { mkdtemp, rm } from "node:fs/promises";
+import { join as join7 } from "node:path";
 
 // src/domain/digest.ts
 function canonicalJson(value) {
   if (value === null || typeof value !== "object") return JSON.stringify(value);
   if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
-  const record2 = value;
-  const keys = Object.keys(record2).sort();
-  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record2[key])}`).join(",")}}`;
+  const record3 = value;
+  const keys = Object.keys(record3).sort();
+  return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record3[key])}`).join(",")}}`;
 }
 
 // src/auth/doctor.ts
@@ -10537,17 +10693,17 @@ var DISABLED = /accessNotConfigured|SERVICE_DISABLED|has not been used in projec
 function probeOutcome(target, result) {
   const parsed = parseResult(result, { maxInlineBytes: 64 * 1024 });
   if (parsed.ok) return { ...target, status: "OK" };
-  if (privilegeRefused(result, parsed)) {
+  if (privilegeRefused(result, target.service, parsed)) {
     return { ...target, status: "ADMIN_PRIVILEGE_REQUIRED", detail: "Google accepted the sign-in, but the account lacks the Workspace admin privilege this service needs" };
   }
-  const problem = authProblem(result, parsed);
+  const problem = authProblem(result, target.service, parsed);
   if (problem === "AUTH_REQUIRED") return { ...target, status: problem, detail: "Google rejected the sign-in" };
   if (problem === "AUTH_SCOPE_MISSING") return { ...target, status: problem, detail: "Google says the sign-in lacks a scope for this service" };
   const error2 = apiError(parsed.data);
-  const text3 = `${error2?.message ?? ""}
+  const text4 = `${error2?.message ?? ""}
 ${result.stderr.toString("utf8")}`;
-  if (DISABLED.test(text3) || error2?.reasons.some((reason) => DISABLED.test(reason))) {
-    const enableUrl = /https:\/\/console\.(?:developers|cloud)\.google\.com\/\S+/.exec(text3)?.[0]?.replace(/[.,)]+$/, "") ?? enableApisUrl([target.service]);
+  if (DISABLED.test(text4) || error2?.reasons.some((reason) => DISABLED.test(reason))) {
+    const enableUrl = /https:\/\/console\.(?:developers|cloud)\.google\.com\/\S+/.exec(text4)?.[0]?.replace(/[.,)]+$/, "") ?? enableApisUrl([target.service]);
     return { ...target, status: "API_DISABLED", detail: "the API is not enabled in the OAuth client's Google Cloud project", enableUrl };
   }
   if (PROBES[target.service]?.notFoundIsOk && (error2?.code === 404 || error2?.code === 400)) return { ...target, status: "OK" };
@@ -10641,9 +10797,8 @@ var Accounts = class {
     );
     return {
       auditDegraded: this.runtime.audit.degraded,
-      pluginVersion: options.pluginVersion,
-      hostVersion: options.hostVersion ?? "unknown",
-      ...options.hostWarning ? { hostWarning: options.hostWarning } : {},
+      version: options.pluginVersion,
+      host: options.host ?? { version: null, range: HOST_RANGE, tested: false },
       binary: { path: this.runtime.binary, version: this.runtime.version },
       services: [...this.runtime.visibleServices()].sort(),
       accounts
@@ -10668,9 +10823,15 @@ var Accounts = class {
     this.runtime.assertActive(ctx.signal);
     const env = buildChildEnv(profile, this.accountDir(account2), this.runtime.workDir, credential?.access);
     report2(ctx, { status: "running", operation });
-    const result = await this.spawn(argv, env, operation, ctx, options.paged === true, options.cwd ?? this.runtime.workDir);
+    const scratch = options.cwd ? void 0 : await mkdtemp(join7(this.runtime.workDir, "call-"));
+    let result;
+    try {
+      result = await this.spawn(argv, env, operation, ctx, options.paged === true, options.cwd ?? scratch);
+    } finally {
+      if (scratch) await rm(scratch, { recursive: true, force: true }).catch(() => void 0);
+    }
     if (credential) {
-      const problem = authProblem(result);
+      const problem = authProblem(result, serviceOf(operation));
       if (problem) this.observeAuth(account2, { status: "needs_auth", code: problem, message: this.authMessage(account2, problem, options.scopes) });
       else if (result.exitCode === 0 && options.dryRun !== true) this.observeAuth(account2, { status: "ok" });
     }
@@ -10723,7 +10884,7 @@ var Accounts = class {
   }
   /** The plugin-owned per-account gws directory: its Discovery cache, and in credentials_file mode its token cache. */
   accountDir(account2) {
-    return ownedDir(join6(this.runtime.paths.cacheDir, "accounts", this.integrationId(account2).replace(/^gws-/, "")));
+    return ownedDir(join7(this.runtime.paths.cacheDir, "accounts", this.integrationId(account2).replace(/^gws-/, "")));
   }
   /** Remediation text for an account's sign-in, consent and admin privilege problems, by credential mode. */
   remediation(account2, scopes, service) {
@@ -10816,16 +10977,20 @@ function delegationField(profile) {
   const services = delegationRequired(profile.enabledServices, profile.scopes);
   return services.length > 0 ? { delegationRequired: services } : {};
 }
-function capitalize(text3) {
-  return text3.charAt(0).toUpperCase() + text3.slice(1);
+function serviceOf(operation) {
+  return operation.slice(0, operation.indexOf("."));
+}
+function capitalize(text4) {
+  return text4.charAt(0).toUpperCase() + text4.slice(1);
 }
 
 // src/domain/classify.ts
-var NOTIFYING_UPDATES = /* @__PURE__ */ new Set(["all", "externalonly"]);
 function emailsAttendees(entry, request) {
   if (entry.service !== "calendar" || entry.path.join(".") !== "events") return false;
-  const value = request.params?.["sendUpdates"];
-  return typeof value === "string" && NOTIFYING_UPDATES.has(value.toLowerCase());
+  const updates = request.params?.["sendUpdates"];
+  const legacy = request.params?.["sendNotifications"];
+  const off = (value, none) => value === void 0 || value === false || typeof value === "string" && value.toLowerCase() === none;
+  return !off(updates, "none") || !off(legacy, "false");
 }
 function effectiveCategory(entry, request) {
   if (entry.category === "deny" || entry.schemaError) return "deny";
@@ -10841,27 +11006,393 @@ function isCommittable(category) {
 
 // src/domain/command.ts
 import { isAbsolute as isAbsolute6 } from "node:path";
-function recipientsOf(request) {
-  const out = /* @__PURE__ */ new Set();
-  const visit = (value, key) => {
+
+// src/domain/recipients.ts
+function addressesIn(text4) {
+  const addresses = [];
+  const unreadable = [];
+  for (const match of text4.matchAll(/([A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]*)@(\[[^\]]*\]?|[^\s<>()[\]\\,;:"@]*)/g)) {
+    const local = match[1].replace(/^\.+/, "");
+    const domain = match[2].toLowerCase().replace(/\.+$/, "");
+    if (!local && !domain) continue;
+    if (!local || !/^[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+$/u.test(domain)) {
+      unreadable.push(match[0]);
+      continue;
+    }
+    addresses.push(`${local.toLowerCase()}@${domain}`);
+  }
+  return { addresses, unreadable };
+}
+function domainOf(address) {
+  return address.slice(address.lastIndexOf("@") + 1);
+}
+var Collector = class {
+  addresses = /* @__PURE__ */ new Set();
+  domains = /* @__PURE__ */ new Set();
+  unknown;
+  public;
+  text(value) {
     if (typeof value === "string") {
-      if (key && /^(to|cc|bcc|email|emailAddress|address|recipient)$/i.test(key) && /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) {
-        out.add(value.toLowerCase());
-      }
+      const found = addressesIn(value);
+      for (const address of found.addresses) this.addresses.add(address);
+      if (found.unreadable.length > 0) this.fail(`an address could not be read: ${found.unreadable[0]}`);
+      return;
+    }
+    if (Array.isArray(value)) for (const item of value) this.text(item);
+  }
+  domain(value) {
+    if (typeof value === "string" && /^[\p{L}\p{N}-]+(?:\.[\p{L}\p{N}-]+)+$/u.test(value.trim())) this.domains.add(value.trim().toLowerCase());
+    else this.fail("the domain it shares with could not be read");
+  }
+  add(set) {
+    for (const address of set.addresses) this.addresses.add(address);
+    for (const domain of set.domains) this.domains.add(domain);
+  }
+  fail(reason) {
+    this.unknown ??= reason;
+  }
+  result() {
+    return {
+      addresses: [...this.addresses],
+      domains: [...this.domains],
+      ...this.unknown ? { unknown: this.unknown } : {},
+      ...this.public ? { public: true } : {}
+    };
+  }
+};
+var RECIPIENT_KEYS = /* @__PURE__ */ new Set(["to", "cc", "bcc", "email", "emailaddress", "address", "recipient", "recipients", "attendees", "delegateemail", "forwardingemail"]);
+function scanRecipients(request) {
+  const out = new Collector();
+  const visit = (value, collecting) => {
+    if (typeof value === "string") {
+      if (collecting) out.text(value);
       return;
     }
     if (Array.isArray(value)) {
-      for (const item of value) visit(item, key);
+      for (const item of value) visit(item, collecting);
       return;
     }
     if (value && typeof value === "object") {
-      for (const [childKey, child] of Object.entries(value)) visit(child, childKey);
+      for (const [key, child] of Object.entries(value)) visit(child, collecting || RECIPIENT_KEYS.has(key.toLowerCase()));
+    }
+  };
+  visit(request.params, false);
+  visit(request.body, false);
+  visit(request.input, false);
+  return out.result();
+}
+function record2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function text3(value) {
+  return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function mimeRecipients(raw) {
+  if (typeof raw !== "string" || raw.length === 0 || !/^[A-Za-z0-9+/_=\s-]+$/.test(raw)) return void 0;
+  const message = Buffer.from(raw.replace(/\s+/g, ""), "base64").toString("utf8");
+  const end = /\r?\n\r?\n/.exec(message);
+  const head = (end ? message.slice(0, end.index) : message).replace(/\r?\n[ \t]+/g, " ");
+  const lines = head.split(/\r?\n/);
+  if (!lines.every((line) => line === "" || /^[!-9;-~]+[ \t]*:/.test(line))) return void 0;
+  return lines.filter((line) => /^(?:to|cc|bcc)[ \t]*:/i.test(line)).map((line) => line.slice(line.indexOf(":") + 1));
+}
+function headers(message) {
+  const list = record2(record2(message)["payload"])["headers"];
+  if (!Array.isArray(list)) return void 0;
+  const out = /* @__PURE__ */ new Map();
+  for (const header of list) {
+    const name = text3(record2(header)["name"])?.toLowerCase();
+    const value = record2(header)["value"];
+    if (name && typeof value === "string") out.set(name, [...out.get(name) ?? [], value]);
+  }
+  return out;
+}
+function setOf(values) {
+  const out = new Collector();
+  out.text(values);
+  return out.unknown ? void 0 : { addresses: [...out.addresses], domains: [] };
+}
+function plan(out, lookups = [], needsSelf = false) {
+  return { known: out.result(), lookups, ...needsSelf ? { needsSelf: true } : {} };
+}
+function helperSend(fields) {
+  return (request) => {
+    const input = record2(request.input);
+    const out = new Collector();
+    for (const field of fields) out.text(input[field]);
+    if (out.addresses.size === 0) out.fail("no recipient address was found");
+    return plan(out);
+  };
+}
+function replySpec(all) {
+  return (request) => {
+    const input = record2(request.input);
+    const out = new Collector();
+    for (const field of ["to", "cc", "bcc"]) out.text(input[field]);
+    const removed = new Set(addressesIn([input["remove"]].flat().filter((item) => typeof item === "string").join(",")).addresses);
+    const messageId = text3(input["messageId"]);
+    if (!messageId) {
+      out.fail("the message being replied to is not named");
+      return plan(out);
+    }
+    const lookup = {
+      operation: "gmail.users.messages.get",
+      params: { userId: "me", id: messageId, format: "metadata", fields: "payload/headers" },
+      what: "the message being replied to",
+      extract(data, self) {
+        const found = headers(data);
+        if (!found) return void 0;
+        const sender = found.get("reply-to") ?? found.get("from") ?? [];
+        const senderSet = setOf(sender);
+        if (!senderSet) return void 0;
+        const values = [...sender];
+        if (all || self !== void 0 && senderSet.addresses.includes(self)) values.push(...found.get("to") ?? []);
+        if (all) values.push(...found.get("cc") ?? []);
+        const set = setOf(values);
+        if (!set) return void 0;
+        const kept = all ? set.addresses.filter((address) => address !== self && !removed.has(address)) : set.addresses;
+        return { addresses: kept, domains: [] };
+      }
+    };
+    return plan(out, [lookup], true);
+  };
+}
+function rawInto(out, raw) {
+  const values = mimeRecipients(raw);
+  if (values) out.text(values);
+  else out.fail("the raw message has no readable header block");
+}
+var messagesSend = (request) => {
+  const out = new Collector();
+  if (request.upload) out.fail("the message is in an uploaded file");
+  else if (record2(request.body)["raw"] === void 0) out.fail("the message has no raw field");
+  else rawInto(out, record2(request.body)["raw"]);
+  if (!out.unknown && out.addresses.size === 0) out.fail("the raw message has no To, Cc or Bcc header");
+  return plan(out);
+};
+var draftsSend = (request) => {
+  const out = new Collector();
+  const body = record2(request.body);
+  const raw = record2(body["message"])["raw"];
+  if (raw !== void 0) rawInto(out, raw);
+  const id = text3(body["id"]);
+  if (!id) {
+    out.fail("the draft is not named (body.id)");
+    return plan(out);
+  }
+  const userId = text3(record2(request.params)["userId"]) ?? "me";
+  const lookup = {
+    operation: "gmail.users.drafts.get",
+    params: { userId, id, format: "metadata", fields: "message/payload/headers" },
+    what: "the draft",
+    none: "the draft could not be read or names no recipient",
+    extract(data) {
+      const found = headers(record2(data)["message"]);
+      return found ? setOf([...found.get("to") ?? [], ...found.get("cc") ?? [], ...found.get("bcc") ?? []]) : void 0;
     }
   };
-  visit(request.params);
-  visit(request.body);
-  return [...out];
+  return plan(out, [lookup]);
+};
+function attendeesInto(out, body) {
+  const attendees = record2(body)["attendees"];
+  if (attendees === void 0) return;
+  if (!Array.isArray(attendees)) {
+    out.fail("the attendees could not be read");
+    return;
+  }
+  for (const attendee of attendees) {
+    const email2 = record2(attendee)["email"];
+    if (typeof email2 === "string") out.text(email2);
+    else out.fail("an attendee has no email");
+  }
 }
+var eventInsert = (request) => {
+  const out = new Collector();
+  attendeesInto(out, request.body);
+  return plan(out);
+};
+var eventChange = (request, category) => {
+  const out = new Collector();
+  attendeesInto(out, request.body);
+  if (category !== "send") return plan(out);
+  const params = record2(request.params);
+  const calendarId = text3(params["calendarId"]);
+  const eventId = text3(params["eventId"]);
+  if (!calendarId || !eventId) {
+    out.fail("the event is not named (calendarId and eventId)");
+    return plan(out);
+  }
+  const lookup = {
+    operation: "calendar.events.get",
+    params: { calendarId, eventId, fields: "attendees(email)" },
+    what: "the event's guests",
+    extract(data) {
+      const attendees = record2(data)["attendees"] ?? [];
+      if (!Array.isArray(attendees)) return void 0;
+      const emails2 = attendees.map((attendee) => record2(attendee)["email"]);
+      return emails2.every((email2) => typeof email2 === "string") ? setOf(emails2) : void 0;
+    }
+  };
+  return plan(out, [lookup]);
+};
+var quickAdd = () => {
+  const out = new Collector();
+  out.fail("Google reads the guests from the text");
+  return plan(out);
+};
+function drivePermissionInto(out, permission) {
+  const type = text3(permission["type"]);
+  if (type === "anyone") return;
+  if (type === "domain") out.domain(permission["domain"]);
+  else if (typeof permission["emailAddress"] === "string") out.text(permission["emailAddress"]);
+  else out.fail("the permission names no emailAddress");
+}
+var drivePermissionCreate = (request) => {
+  const out = new Collector();
+  drivePermissionInto(out, record2(request.body));
+  return plan(out);
+};
+var drivePermissionUpdate = (request) => {
+  const out = new Collector();
+  const params = record2(request.params);
+  const fileId = text3(params["fileId"]);
+  const permissionId = text3(params["permissionId"]);
+  if (!fileId || !permissionId) {
+    out.fail("the permission is not named (fileId and permissionId)");
+    return plan(out);
+  }
+  const lookup = {
+    operation: "drive.permissions.get",
+    // The request's own parameters, so a shared-drive flag it carries applies to the read too.
+    params: { ...params, fields: "type,emailAddress,domain" },
+    what: "the permission",
+    extract(data) {
+      const found = new Collector();
+      drivePermissionInto(found, record2(data));
+      return found.unknown ? void 0 : found.result();
+    }
+  };
+  return plan(out, [lookup]);
+};
+function aclScopeInto(out, type, value) {
+  if (type === "default") out.public = true;
+  else if (type === "domain") out.domain(value);
+  else if ((type === "user" || type === "group") && typeof value === "string") out.text(value);
+  else out.fail("the ACL scope could not be read");
+}
+var aclChange = (request) => {
+  const out = new Collector();
+  const scope = record2(record2(request.body)["scope"]);
+  if (Object.keys(scope).length > 0) aclScopeInto(out, text3(scope["type"]), scope["value"]);
+  const ruleId = text3(record2(request.params)["ruleId"]);
+  if (ruleId) {
+    const colon = ruleId.indexOf(":");
+    aclScopeInto(out, colon < 0 ? ruleId : ruleId.slice(0, colon), colon < 0 ? void 0 : ruleId.slice(colon + 1));
+  }
+  if (Object.keys(scope).length === 0 && !ruleId) out.fail("the ACL scope could not be read");
+  return plan(out);
+};
+function bodyAddress(field, optional2) {
+  return (request) => {
+    const out = new Collector();
+    const body = record2(request.body);
+    if (optional2?.(body)) return plan(out);
+    const value = body[field];
+    if (typeof value === "string" && value.includes("@")) out.text(value);
+    else out.fail(`body.${field} is not an email address`);
+    return plan(out);
+  };
+}
+var chatMember = (request) => {
+  const out = new Collector();
+  const name = text3(record2(record2(request.body)["member"])["name"]);
+  if (name?.startsWith("users/") && name.includes("@")) out.text(name.slice("users/".length));
+  else out.fail("the member is not named by email (users/<email>)");
+  return plan(out);
+};
+var keepPermissions = (request) => {
+  const out = new Collector();
+  const requests = record2(request.body)["requests"];
+  if (!Array.isArray(requests) || requests.length === 0) out.fail("the permission requests could not be read");
+  else {
+    for (const item of requests) {
+      const email2 = record2(record2(item)["permission"])["email"];
+      if (typeof email2 === "string") out.text(email2);
+      else out.fail("a permission names no email");
+    }
+  }
+  return plan(out);
+};
+var revoke = () => plan(new Collector());
+var SPECS = {
+  "gmail.send": helperSend(["to", "cc", "bcc"]),
+  "gmail.forward": helperSend(["to", "cc", "bcc"]),
+  "gmail.reply": replySpec(false),
+  "gmail.reply-all": replySpec(true),
+  "gmail.users.messages.send": messagesSend,
+  "gmail.users.drafts.send": draftsSend,
+  "gmail.users.settings.delegates.create": bodyAddress("delegateEmail"),
+  "gmail.users.settings.forwardingAddresses.create": bodyAddress("forwardingEmail"),
+  "gmail.users.settings.updateAutoForwarding": bodyAddress("emailAddress", (body) => body["enabled"] === false),
+  "gmail.users.settings.delegates.delete": revoke,
+  "gmail.users.settings.forwardingAddresses.delete": revoke,
+  "calendar.events.insert": eventInsert,
+  "calendar.events.import": eventInsert,
+  "calendar.events.quickAdd": quickAdd,
+  "calendar.events.update": eventChange,
+  "calendar.events.patch": eventChange,
+  "calendar.events.delete": eventChange,
+  "calendar.events.move": eventChange,
+  "calendar.acl.insert": aclChange,
+  "calendar.acl.update": aclChange,
+  "calendar.acl.patch": aclChange,
+  "calendar.acl.delete": revoke,
+  "drive.permissions.create": drivePermissionCreate,
+  "drive.permissions.update": drivePermissionUpdate,
+  "drive.permissions.delete": revoke,
+  "chat.spaces.members.create": chatMember,
+  "chat.spaces.members.delete": revoke,
+  "classroom.invitations.create": bodyAddress("userId"),
+  "classroom.invitations.delete": revoke,
+  "classroom.courses.studentGroups.studentGroupMembers.create": bodyAddress("userId"),
+  "meet.spaces.members.create": bodyAddress("email"),
+  "keep.notes.permissions.batchCreate": keepPermissions,
+  "keep.notes.permissions.batchDelete": revoke
+};
+function recipientPlan(operation, category, request) {
+  const spec2 = SPECS[operation];
+  if (spec2) return spec2(request, category);
+  const scanned = scanRecipients(request);
+  if (category === "send" || category === "share") {
+    return { known: { ...scanned, unknown: scanned.unknown ?? `the plugin cannot tell who ${operation} reaches` }, lookups: [] };
+  }
+  return { known: scanned, lookups: [] };
+}
+function withLookup(recipients, found, lookup) {
+  if (!found) return { ...recipients, unknown: recipients.unknown ?? `${lookup.what} could not be read` };
+  const merged = {
+    ...recipients,
+    addresses: [.../* @__PURE__ */ new Set([...recipients.addresses, ...found.addresses])],
+    domains: [.../* @__PURE__ */ new Set([...recipients.domains, ...found.domains])]
+  };
+  if (lookup.none && merged.addresses.length === 0 && merged.domains.length === 0) merged.unknown ??= lookup.none;
+  return merged;
+}
+function recipientLabels(recipients) {
+  return [...recipients.addresses, ...recipients.domains.map((domain) => `*@${domain}`)];
+}
+var ACCOUNT_ADDRESS_READS = {
+  gmail: { operation: "gmail.users.getProfile", params: { userId: "me", fields: "emailAddress" }, extract: (data) => ownAddress(record2(data)["emailAddress"]) },
+  drive: { operation: "drive.about.get", params: { fields: "user(emailAddress)" }, extract: (data) => ownAddress(record2(record2(data)["user"])["emailAddress"]) },
+  calendar: { operation: "calendar.calendars.get", params: { calendarId: "primary", fields: "id" }, extract: (data) => ownAddress(record2(data)["id"]) }
+};
+function ownAddress(value) {
+  if (typeof value !== "string") return void 0;
+  const found = addressesIn(value);
+  return found.addresses.length === 1 && found.unreadable.length === 0 ? found.addresses[0] : void 0;
+}
+
+// src/domain/command.ts
 function wantsPages(request) {
   const pagination = request.pagination ?? {};
   return pagination.all === true || pagination.maxPages !== void 0 || pagination.maxItems !== void 0;
@@ -10940,7 +11471,7 @@ function buildCommand(entry, request, config2, options) {
       url: entry.pathTemplate,
       params: redactParams(params),
       bodySummary: request.body === void 0 ? void 0 : summarizeBody(request.body),
-      recipients: recipientsOf(request),
+      recipients: recipientLabels(scanRecipients(request)),
       uploads: request.upload ? [request.upload.path] : void 0,
       destination: request.download?.path,
       overwrite: request.download?.overwrite === true ? true : void 0,
@@ -10978,32 +11509,6 @@ function matches2(rule, category, account2, service, operation) {
 function underRoot2(path, roots) {
   return roots.some((root) => underRoot(path, root));
 }
-function collectEmails(value, out) {
-  if (typeof value === "string") {
-    if (/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)) out.add(value.toLowerCase());
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) collectEmails(item, out);
-    return;
-  }
-  if (value && typeof value === "object") {
-    for (const [key, item] of Object.entries(value)) {
-      if (key === "email" || key === "emailAddress" || key === "address" || key === "to" || key === "cc" || key === "bcc" || key === "recipient" || key === "attendees") {
-        collectEmails(item, out);
-      } else if (typeof item === "object") {
-        collectEmails(item, out);
-      }
-    }
-  }
-}
-function emails2(request) {
-  const out = /* @__PURE__ */ new Set();
-  collectEmails(request.params, out);
-  collectEmails(request.body, out);
-  collectEmails(request.input, out);
-  return [...out];
-}
 function helperPaths(request, keys) {
   const input = request.input;
   if (!input || typeof input !== "object") return [];
@@ -11021,13 +11526,19 @@ function publicSharing(request) {
   const haystack = JSON.stringify({ params: request.params ?? {}, body: request.body ?? {}, input: request.input ?? {} }).toLowerCase();
   return /"role"\s*:\s*"(anyone|public)"/.test(haystack) || /"type"\s*:\s*"(anyone|public)"/.test(haystack);
 }
-function domain(email2) {
-  return email2.slice(email2.lastIndexOf("@") + 1);
+function limitsRecipients(rule) {
+  return rule.allowedRecipientDomains !== void 0 || rule.allowedRecipients !== void 0 || rule.deniedRecipientDomains !== void 0 || rule.allowExternalRecipients === false;
+}
+function matching(config2, entry, category, request) {
+  return config2.policy.rules.filter((rule) => matches2(rule, category, request.account, entry.service, entry.id));
+}
+function needsAccountDomains(config2, entry, category, request) {
+  return matching(config2, entry, category, request).some((rule) => rule.allowExternalRecipients === false);
 }
 function constrained(rule) {
   return rule.allowedRecipientDomains !== void 0 || rule.allowedRecipients !== void 0 || rule.deniedRecipientDomains !== void 0 || rule.allowExternalRecipients !== void 0 || rule.allowPublicSharing !== void 0 || rule.allowedReadRoots !== void 0 || rule.allowedWriteRoots !== void 0 || rule.maxPages !== void 0 || rule.maxItems !== void 0;
 }
-function evaluatePolicy(config2, entry, category, request) {
+function evaluatePolicy(config2, entry, category, request, facts) {
   const constraints = {
     maxPages: config2.execution.maxPages,
     maxItems: config2.execution.maxItems,
@@ -11037,31 +11548,21 @@ function evaluatePolicy(config2, entry, category, request) {
     writeRoots: config2.execution.allowedWriteRoots.length > 0 ? [config2.execution.allowedWriteRoots] : []
   };
   const violations = [];
-  if (entry.category === "deny" || entry.schemaError) {
-    return { effect: "deny", violations: ["manifest-deny"], constraints };
-  }
-  if (!config2.accounts[request.account]) {
-    return { effect: "deny", violations: ["account-unknown"], constraints };
-  }
+  const refuse = (violation) => ({ effect: "deny", violations: [violation], constraints, code: "POLICY_DENIED" });
+  if (entry.category === "deny" || entry.schemaError) return refuse("manifest-deny");
+  if (!config2.accounts[request.account]) return refuse("account-unknown");
   const profile = config2.accounts[request.account];
   const service = entry.service;
-  if (!profile.enabledServices.includes(service)) {
-    return { effect: "deny", violations: ["service-disabled"], constraints };
-  }
-  if (category === "deploy" || category === "watch" || category === "deny") {
-    return { effect: "deny", violations: ["never-committable"], constraints };
-  }
+  if (!profile.enabledServices.includes(service)) return refuse("service-disabled");
+  if (category === "deploy" || category === "watch" || category === "deny") return refuse("never-committable");
   if (category === "admin") {
-    if (!config2.admin.enabled) {
-      return { effect: "deny", violations: ["admin-disabled"], constraints };
-    }
-    if (!config2.admin.allowedServices.includes(service)) {
-      return { effect: "deny", violations: ["admin-service-not-allowed"], constraints };
-    }
+    if (!config2.admin.enabled) return refuse("admin-disabled");
+    if (!config2.admin.allowedServices.includes(service)) return refuse("admin-service-not-allowed");
   }
   let denied2 = false;
   let ruleId;
-  const recipients = emails2(request);
+  let unknownRecipients = 0;
+  let unknownDomain = 0;
   const readPaths = [
     ...request.upload?.path ? [request.upload.path] : [],
     ...helperPaths(request, ["path", "file", "filePath", "source", "attachments"])
@@ -11070,28 +11571,44 @@ function evaluatePolicy(config2, entry, category, request) {
     ...request.download?.path ? [request.download.path] : [],
     ...helperPaths(request, ["destination", "output", "outPath"])
   ];
-  const external = recipients.filter((email2) => domain(email2) !== domain(recipients[0] ?? ""));
-  const isPublic = publicSharing(request);
-  for (const rule of config2.policy.rules) {
-    if (!matches2(rule, category, request.account, service, entry.id)) continue;
+  const recipients = facts === "pending" ? void 0 : facts.recipients;
+  const targets = recipients ? [
+    ...recipients.addresses.map((address) => ({ label: address, address, domain: domainOf(address) })),
+    ...recipients.domains.map((domain) => ({ label: `*@${domain}`, address: void 0, domain }))
+  ] : [];
+  const own2 = facts === "pending" || !facts.accountDomains ? void 0 : new Set(facts.accountDomains.map((value) => value.toLowerCase()));
+  const isPublic = publicSharing(request) || recipients?.public === true;
+  for (const rule of matching(config2, entry, category, request)) {
     const before = violations.length;
-    if (rule.allowedRecipientDomains && recipients.length > 0) {
-      const allowed = new Set(rule.allowedRecipientDomains.map((value) => value.toLowerCase()));
-      const bad = recipients.filter((email2) => !allowed.has(domain(email2)));
-      if (bad.length > 0) violations.push(`recipients outside allowed domains: ${bad.join(", ")}`);
-    }
-    if (rule.allowedRecipients && recipients.length > 0) {
-      const allowed = new Set(rule.allowedRecipients.map((value) => value.trim().toLowerCase()));
-      const bad = recipients.filter((email2) => !allowed.has(email2));
-      if (bad.length > 0) violations.push(`recipients not in allowedRecipients: ${bad.join(", ")}`);
-    }
-    if (rule.deniedRecipientDomains) {
-      const denied3 = new Set(rule.deniedRecipientDomains.map((value) => value.toLowerCase()));
-      const bad = recipients.filter((email2) => denied3.has(domain(email2)));
-      if (bad.length > 0) violations.push(`recipients in denied domains: ${bad.join(", ")}`);
-    }
-    if (rule.allowExternalRecipients === false && external.length > 0) {
-      violations.push(`external recipients are disabled: ${external.join(", ")}`);
+    if (recipients && limitsRecipients(rule)) {
+      if (recipients.unknown) {
+        violations.push(`rule ${rule.id} limits recipients, but they could not be determined: ${recipients.unknown}`);
+        unknownRecipients++;
+      }
+      if (rule.allowedRecipientDomains) {
+        const allowed = new Set(rule.allowedRecipientDomains.map((value) => value.toLowerCase()));
+        const bad = targets.filter((target) => !allowed.has(target.domain));
+        if (bad.length > 0) violations.push(`recipients outside allowed domains: ${bad.map((target) => target.label).join(", ")}`);
+      }
+      if (rule.allowedRecipients) {
+        const allowed = new Set(rule.allowedRecipients.map((value) => value.trim().toLowerCase()));
+        const bad = targets.filter((target) => target.address === void 0 || !allowed.has(target.address));
+        if (bad.length > 0) violations.push(`recipients not in allowedRecipients: ${bad.map((target) => target.label).join(", ")}`);
+      }
+      if (rule.deniedRecipientDomains) {
+        const deniedDomains = new Set(rule.deniedRecipientDomains.map((value) => value.toLowerCase()));
+        const bad = targets.filter((target) => deniedDomains.has(target.domain));
+        if (bad.length > 0) violations.push(`recipients in denied domains: ${bad.map((target) => target.label).join(", ")}`);
+      }
+      if (rule.allowExternalRecipients === false && (targets.length > 0 || recipients.unknown)) {
+        if (!own2) {
+          violations.push(`rule ${rule.id} disables external recipients, but the account's own domain is unknown`);
+          unknownDomain++;
+        } else {
+          const external = targets.filter((target) => !own2.has(target.domain));
+          if (external.length > 0) violations.push(`external recipients are disabled: ${external.map((target) => target.label).join(", ")}`);
+        }
+      }
     }
     if (rule.allowPublicSharing === false && isPublic) {
       violations.push("public sharing is disabled");
@@ -11129,16 +11646,18 @@ function evaluatePolicy(config2, entry, category, request) {
     violations.push("admin plans require a non-empty reason");
   }
   if (violations.length > 0 || denied2) {
-    return { effect: "deny", ruleId, violations: violations.length > 0 ? violations : [`denied by rule ${ruleId ?? "policy"}`], constraints };
+    const definite = violations.length - unknownRecipients - unknownDomain;
+    const code2 = definite > 0 || violations.length === 0 ? "POLICY_DENIED" : unknownRecipients > 0 ? "RECIPIENTS_UNKNOWN" : "ACCOUNT_DOMAIN_UNKNOWN";
+    return { effect: "deny", ruleId, violations: violations.length > 0 ? violations : [`denied by rule ${ruleId ?? "policy"}`], constraints, code: code2 };
   }
-  return { effect: "allow", ruleId, violations, constraints };
+  return { effect: "allow", ruleId, violations, constraints, code: "POLICY_DENIED" };
 }
 
 // src/process/staging.ts
 import { createHash as createHash3 } from "node:crypto";
 import { constants } from "node:fs";
-import { link, lstat, mkdir as mkdir2, mkdtemp, open as open2, realpath, rename, rm, stat, unlink, writeFile as writeFile2 } from "node:fs/promises";
-import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute7, join as join7 } from "node:path";
+import { link, lstat, mkdir as mkdir2, mkdtemp as mkdtemp2, open as open2, realpath, rename as rename2, rm as rm2, stat as stat2, unlink, writeFile as writeFile2 } from "node:fs/promises";
+import { basename as basename2, dirname as dirname5, isAbsolute as isAbsolute7, join as join8 } from "node:path";
 var CHUNK = 64 * 1024;
 var READ_FLAGS = constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0);
 var Stage = class _Stage {
@@ -11150,13 +11669,13 @@ var Stage = class _Stage {
   signal;
   static async create(workDir, signal) {
     throwIfCancelled(signal);
-    const dir = await mkdtemp(join7(workDir, "call-"));
+    const dir = await mkdtemp2(join8(workDir, "call-"));
     try {
       throwIfCancelled(signal);
-      await writeFile2(join7(dir, ".env"), "", { mode: 384 });
+      await writeFile2(join8(dir, ".env"), "", { mode: 384 });
       return new _Stage(dir, signal);
     } catch (error2) {
-      await rm(dir, { recursive: true, force: true }).catch(() => void 0);
+      await rm2(dir, { recursive: true, force: true }).catch(() => void 0);
       throw error2;
     }
   }
@@ -11170,7 +11689,7 @@ var Stage = class _Stage {
   /** Create the directory gws writes the output into. */
   async prepareOutput(output) {
     throwIfCancelled(this.signal);
-    await mkdir2(dirname5(join7(this.dir, output.rel)), { recursive: true, mode: 448 });
+    await mkdir2(dirname5(join8(this.dir, output.rel)), { recursive: true, mode: 448 });
   }
   /**
    * Move the staged output to its destination: size cap, then the same
@@ -11180,7 +11699,7 @@ var Stage = class _Stage {
    */
   async deliver(output, limits) {
     throwIfCancelled(this.signal);
-    const staged = join7(this.dir, output.rel);
+    const staged = join8(this.dir, output.rel);
     const info = await lstat(staged).catch(() => void 0);
     if (!info?.isFile()) throw new GwsError("DOWNLOAD_INVALID", "gws did not write the output file", { next: "Report it; the plan is used up." });
     if (info.size > limits.maxDownloadBytes) {
@@ -11192,7 +11711,7 @@ var Stage = class _Stage {
     return { path: output.destination, bytes: info.size, sha256, ...cleanupDegraded ? { cleanupDegraded: true } : {} };
   }
   async dispose() {
-    await rm(this.dir, { recursive: true, force: true });
+    await rm2(this.dir, { recursive: true, force: true });
   }
   async stageInput(input, maxBytes, roots) {
     throwIfCancelled(this.signal);
@@ -11204,7 +11723,7 @@ var Stage = class _Stage {
         next: "Use a file inside execution.allowedReadRoots, or ask the user to add its folder there."
       });
     }
-    if (!(await stat(real)).isFile()) throw new GwsError("UPLOAD_INVALID", `'${input.source}' is not a regular file`);
+    if (!(await stat2(real)).isFile()) throw new GwsError("UPLOAD_INVALID", `'${input.source}' is not a regular file`);
     let source;
     let target;
     try {
@@ -11212,7 +11731,7 @@ var Stage = class _Stage {
       const info = await source.stat();
       if (!info.isFile()) throw new GwsError("UPLOAD_INVALID", `'${input.source}' is not a regular file`);
       if (info.size > maxBytes) throw uploadLimit(input.source, info.size, maxBytes);
-      const destination = join7(this.dir, input.rel);
+      const destination = join8(this.dir, input.rel);
       throwIfCancelled(this.signal);
       await mkdir2(dirname5(destination), { recursive: true, mode: 448 });
       throwIfCancelled(this.signal);
@@ -11242,7 +11761,7 @@ async function checkDestination(output, limits) {
   if (!isAbsolute7(output.destination)) throw new GwsError("DOWNLOAD_INVALID", `'${output.destination}' must be an absolute path`);
   const parent = await realpath(dirname5(output.destination)).catch(() => void 0);
   if (!parent) throw new GwsError("DOWNLOAD_INVALID", `the directory for '${output.destination}' does not exist`);
-  const target = join7(parent, basename2(output.destination));
+  const target = join8(parent, basename2(output.destination));
   if (!withinRootSets(target, await realRootSets(limits.writeRoots))) {
     throw new GwsError("POLICY_DENIED", `download path '${output.destination}' resolves outside allowed write roots`, {
       next: "Use a destination inside execution.allowedWriteRoots, or ask the user to add its folder there."
@@ -11256,20 +11775,20 @@ async function checkDestination(output, limits) {
 async function place(staged, target, output, signal) {
   throwIfCancelled(signal);
   try {
-    if (output.overwrite) await rename(staged, target);
+    if (output.overwrite) await rename2(staged, target);
     else await link(staged, target);
     return false;
   } catch (error2) {
     if (code(error2) === "EEXIST") throw exists(output.destination);
     if (code(error2) !== "EXDEV" && code(error2) !== "EPERM" && code(error2) !== "ENOTSUP") throw error2;
   }
-  const temp = join7(dirname5(target), `.${basename2(target)}.${process.pid}.${Date.now()}.partial`);
+  const temp = join8(dirname5(target), `.${basename2(target)}.${process.pid}.${Date.now()}.partial`);
   let cleanupDegraded = false;
   try {
     throwIfCancelled(signal);
     await copyDurable(staged, temp, signal);
     throwIfCancelled(signal);
-    if (output.overwrite) await rename(temp, target);
+    if (output.overwrite) await rename2(temp, target);
     else {
       try {
         await link(temp, target);
@@ -11338,6 +11857,17 @@ function code(error2) {
 // src/runtime/operations.ts
 var METHOD_FIELDS = ["params", "body", "fields", "pagination", "upload", "download"];
 var PLAN_INSTEAD = "Call gws_plan with the same request, then commit with the tool named by the plan's category.";
+var SAVE_INSTEAD = "Google answered with a body that is not JSON. To save it, plan the same request with download.path, then commit it with gws_export.";
+var ADDRESS_TTL_MS = 10 * 60 * 1e3;
+function policyError(decision, account2) {
+  const detail = decision.violations.join("; ");
+  if (decision.code === "ACCOUNT_DOMAIN_UNKNOWN") {
+    return new GwsError("ACCOUNT_DOMAIN_UNKNOWN", detail, {
+      next: `Ask the user to set accounts.${account2}.domains to the account's email domains, or to enable Gmail, Drive or Calendar for '${account2}' so the plugin can read its address.`
+    });
+  }
+  return new GwsError(decision.code, detail);
+}
 var Operations = class {
   constructor(runtime, accounts) {
     this.runtime = runtime;
@@ -11345,6 +11875,8 @@ var Operations = class {
   }
   runtime;
   accounts;
+  /** Each account's own address, once read. */
+  addresses = /* @__PURE__ */ new Map();
   /** The configured account a call names, or the only one when it names none. */
   account(alias) {
     const aliases = Object.keys(this.runtime.config.accounts);
@@ -11416,8 +11948,9 @@ var Operations = class {
           throw new GwsError("POLICY_DENIED", `'${entry.id}' is ${category2}; use gws_plan and the matching commit tool`, { next: PLAN_INSTEAD });
         }
       }
-      const decision2 = evaluatePolicy(this.runtime.config, entry, "read", request);
-      if (decision2.effect === "deny") throw new GwsError("POLICY_DENIED", decision2.violations.join("; "));
+      const facts = { recipients: recipientPlan(entry.id, "read", request).known, accountDomains: this.runtime.config.accounts[request.account]?.domains };
+      const decision2 = evaluatePolicy(this.runtime.config, entry, "read", request, facts);
+      if (decision2.effect === "deny") throw policyError(decision2, request.account);
       return { category: "read", decision: decision2 };
     }
     const category = helper ? helper.category : effectiveCategory(entry, request);
@@ -11426,8 +11959,8 @@ var Operations = class {
         next: category === "read" ? "Run it with gws_read." : "Tell the user the plugin never runs it."
       });
     }
-    const decision = evaluatePolicy(this.runtime.config, entry, category, request);
-    if (decision.effect === "deny") throw new GwsError("POLICY_DENIED", decision.violations.join("; "));
+    const decision = evaluatePolicy(this.runtime.config, entry, category, request, "pending");
+    if (decision.effect === "deny") throw policyError(decision, request.account);
     if (category === "admin" && (!this.runtime.config.admin.enabled || decision.effect !== "allow")) {
       throw new GwsError("POLICY_DENIED", "admin operations require admin.enabled, an allowed service, and a reason when one is required");
     }
@@ -11440,11 +11973,13 @@ var Operations = class {
   inspect(input, mode) {
     const resolved = this.resolve(input);
     const { category } = this.gate(resolved, mode);
+    const reads = mode === "plan" ? recipientPlan(resolved.entry.id, category, resolved.request).lookups.map((lookup) => lookup.operation) : [];
     return {
       account: resolved.request.account,
       operation: resolved.entry.id,
       service: resolved.entry.service,
-      category
+      category,
+      ...reads.length > 0 ? { reads } : {}
     };
   }
   /**
@@ -11500,7 +12035,7 @@ var Operations = class {
         requestedInlineBytes: helper ? void 0 : request.response?.maxInlineBytes
       });
       const failed = helper ? result.exitCode !== 0 || isApiError(parsed.data) : !parsed.ok;
-      if (failed) throw processError(result, parsed, this.accounts.remediation(request.account, entry.scopes, entry.service));
+      if (failed) throw processError(result, parsed, entry.service, this.accounts.remediation(request.account, entry.scopes, entry.service));
       const pages = paged ? capPageItems(parsed.data, itemCap(request, limits)) : void 0;
       const cap = inlineCap(this.runtime.config.execution.maxInlineBytes, request.response?.mode, request.response?.maxInlineBytes);
       const truncated = pages ? Buffer.byteLength(JSON.stringify(pages.data)) > cap : parsed.truncated;
@@ -11517,7 +12052,7 @@ var Operations = class {
         ok: true,
         operation: entry.id,
         category: "read",
-        data: helper ? parsed.data ?? parsed.raw ?? result.stdout.toString("utf8") : pages ? pages.data : parsed.data,
+        data: helper ? parsed.data ?? parsed.raw ?? result.stdout.toString("utf8") : pages ? pages.data : withoutSavedBody(parsed.data, SAVE_INSTEAD),
         truncated,
         diagnostics: parsed.diagnostics,
         pagination: pages ? { pages: pages.pages, items: pages.items, capped: pages.capped } : void 0,
@@ -11532,8 +12067,12 @@ var Operations = class {
     const resolved = this.resolve(input);
     const { entry, helper, request } = resolved;
     const started = Date.now();
-    const { category, decision } = this.gate(resolved, "plan");
+    const { category } = this.gate(resolved, "plan");
     const commitCategory = category;
+    const recipientsPlan = recipientPlan(entry.id, category, request);
+    const facts = await this.policyFacts(resolved, category, recipientsPlan, ctx);
+    const decision = evaluatePolicy(this.runtime.config, entry, category, request, facts);
+    if (decision.effect === "deny") throw policyError(decision, request.account);
     const limits = fileLimits(decision);
     let dryRunArgv;
     let commitArgv;
@@ -11564,14 +12103,16 @@ var Operations = class {
       const dry = await this.accounts.run(dryRunArgv, request.account, entry.id, ctx, { scopes: entry.scopes, dryRun: true, cwd: stage?.dir });
       report2(ctx, { status: "parsing", operation: entry.id });
       parsed = parseResult(dry, { maxInlineBytes: this.runtime.config.execution.maxInlineBytes });
-      if (dry.exitCode !== 0 || !parsed.ok) throw processError(dry, parsed, this.accounts.remediation(request.account, entry.scopes, entry.service));
+      if (dry.exitCode !== 0 || !parsed.ok) throw processError(dry, parsed, entry.service, this.accounts.remediation(request.account, entry.scopes, entry.service));
     } finally {
       await stage?.dispose();
     }
     throwIfCancelled(ctx.signal);
     const reason = request.reason?.trim();
-    const planPreview = reason ? { ...preview, reason } : preview;
-    const plan = this.runtime.plans.create({
+    const { recipients } = facts;
+    const reached = category === "send" || category === "share" ? { ...preview, recipients: recipientLabels(recipients), ...recipients.unknown ? { recipientsUnknown: recipients.unknown } : {} } : preview;
+    const planPreview = reason ? { ...reached, reason } : reached;
+    const plan2 = this.runtime.plans.create({
       account: request.account,
       sessionId: ctx.sessionId,
       agentId: ctx.agentId,
@@ -11581,6 +12122,8 @@ var Operations = class {
       argv: commitArgv,
       preview: planPreview,
       files: planned,
+      // Recipients read at plan time can change before the commit (a draft, an event's guests): the commit reads them again.
+      ...recipientsPlan.lookups.length > 0 ? { recheck: { request, recipients: facts.recipients.addresses.concat(facts.recipients.domains) } } : {},
       ttlSeconds: this.runtime.config.policy.planTtlSeconds
     });
     this.runtime.audit.emit({
@@ -11594,8 +12137,8 @@ var Operations = class {
     });
     return {
       ok: true,
-      planId: plan.id,
-      expiresAt: new Date(plan.expiresAt).toISOString(),
+      planId: plan2.id,
+      expiresAt: new Date(plan2.expiresAt).toISOString(),
       category: commitCategory,
       preview: planPreview,
       dryRun: redactDryRun(parsed.data)
@@ -11606,7 +12149,7 @@ var Operations = class {
     throwIfCancelled(ctx.signal);
     if (existing.files?.output) await checkDestination(existing.files.output, existing.files.limits);
     this.runtime.assertActive(ctx.signal);
-    const plan = this.runtime.plans.acquire(input.planId, {
+    const plan2 = this.runtime.plans.acquire(input.planId, {
       sessionId: ctx.sessionId,
       agentId: ctx.agentId,
       account: existing.account,
@@ -11616,39 +12159,41 @@ var Operations = class {
     let stage;
     let receipt;
     try {
-      if (plan.files) stage = await Stage.create(this.runtime.workDir, ctx.signal);
-      if (stage && plan.files) {
-        const staged = await stage.stageInputs(plan.files.inputs, plan.files.limits);
-        refuseChanged(plan.files.inputs, staged);
-        if (plan.files.output) await stage.prepareOutput(plan.files.output);
-      }
-      const method = commandIndex().methods.get(plan.operation);
+      if (plan2.recheck) await this.recheck(plan2, ctx);
+      if (plan2.files) stage = await Stage.create(this.runtime.workDir, ctx.signal);
+      if (stage && plan2.files) {
+        const staged = await stage.stageInputs(plan2.files.inputs, plan2.files.limits);
+        refuseChanged(plan2.files.inputs, staged);
+        if (plan2.files.output) await stage.prepareOutput(plan2.files.output);
+      }
+      const method = commandIndex().methods.get(plan2.operation);
       const scopes = method?.scopes;
-      const result = await this.accounts.run(plan.argv, plan.account, plan.operation, ctx, { scopes, cwd: stage?.dir });
-      report2(ctx, { status: "parsing", operation: plan.operation });
+      const result = await this.accounts.run(plan2.argv, plan2.account, plan2.operation, ctx, { scopes, cwd: stage?.dir });
+      report2(ctx, { status: "parsing", operation: plan2.operation });
       const parsed = parseResult(result, { maxInlineBytes: this.runtime.config.execution.maxInlineBytes });
-      if (!parsed.ok) throw processError(result, parsed, this.accounts.remediation(plan.account, scopes, method?.service));
-      const delivered = stage && plan.files?.output ? await stage.deliver(plan.files.output, plan.files.limits) : void 0;
+      if (!parsed.ok) throw processError(result, parsed, plan2.service, this.accounts.remediation(plan2.account, scopes, plan2.service));
+      const delivered = stage && plan2.files?.output ? await stage.deliver(plan2.files.output, plan2.files.limits) : void 0;
       const file = delivered ? { path: delivered.path, bytes: delivered.bytes, sha256: delivered.sha256 } : void 0;
-      this.runtime.plans.complete(plan.id);
+      this.runtime.plans.complete(plan2.id);
       this.runtime.audit.emit({
         event: "operation.commit",
         outcome: "success",
-        account: plan.account,
+        account: plan2.account,
         category,
-        operation: plan.operation,
+        operation: plan2.operation,
         durationMs: Date.now() - started
       });
-      receipt = { ok: true, planId: plan.id, category, operation: plan.operation, result: parsed.data ?? parsed.raw, file, ...delivered?.cleanupDegraded ? { cleanupDegraded: true } : {} };
+      const answer = plan2.files?.output ? parsed.data : withoutSavedBody(parsed.data);
+      receipt = { ok: true, planId: plan2.id, category, operation: plan2.operation, result: answer ?? parsed.raw, file, ...delivered?.cleanupDegraded ? { cleanupDegraded: true } : {} };
       return receipt;
     } catch (error2) {
-      this.runtime.plans.release(plan.id);
+      this.runtime.plans.release(plan2.id);
       this.runtime.audit.emit({
         event: "operation.commit",
         outcome: "error",
-        account: plan.account,
+        account: plan2.account,
         category,
-        operation: plan.operation,
+        operation: plan2.operation,
         durationMs: Date.now() - started,
         errorCode: auditErrorCode(error2)
       });
@@ -11668,6 +12213,85 @@ var Operations = class {
       }
     }
   }
+  /**
+   * The recipient facts for a plan: what the request carries, the reads
+   * that find the rest, and the account's own domains when a rule needs them.
+   * A read that fails leaves the recipients unknown, which a recipient rule refuses.
+   */
+  async policyFacts(resolved, category, plan2, ctx) {
+    const { entry, request } = resolved;
+    let recipients = plan2.known;
+    if (plan2.lookups.length > 0) {
+      const self = plan2.needsSelf ? await this.ownAddress(request.account, entry.service, ctx) : void 0;
+      for (const lookup of plan2.lookups) recipients = withLookup(recipients, await this.lookup(lookup, request.account, ctx, self), lookup);
+    }
+    const configured = this.runtime.config.accounts[request.account]?.domains;
+    const reaches = recipients.addresses.length > 0 || recipients.domains.length > 0 || recipients.unknown !== void 0;
+    if (configured || !reaches || !needsAccountDomains(this.runtime.config, entry, category, request)) return { recipients, accountDomains: configured };
+    const address = await this.ownAddress(request.account, entry.service, ctx);
+    return { recipients, accountDomains: address ? [domainOf(address)] : void 0 };
+  }
+  /** Read the recipients again before a commit whose plan read them, and refuse when the policy now denies or someone was added. */
+  async recheck(plan2, ctx) {
+    const recheck = plan2.recheck;
+    const resolved = this.resolve(recheck.request);
+    const category = plan2.category;
+    const facts = await this.policyFacts(resolved, category, recipientPlan(resolved.entry.id, category, resolved.request), ctx);
+    const decision = evaluatePolicy(this.runtime.config, resolved.entry, category, resolved.request, facts);
+    if (decision.effect === "deny") throw policyError(decision, plan2.account);
+    const planned = new Set(recheck.recipients);
+    const added = [...facts.recipients.addresses, ...facts.recipients.domains].filter((recipient) => !planned.has(recipient));
+    if (added.length > 0) {
+      throw new GwsError("PLAN_EXPIRED", `the recipients changed after the plan was created (added: ${added.join(", ")})`, { next: "Plan again and show the new preview." });
+    }
+  }
+  /** One recipient read; undefined when it fails or answers in an unexpected shape. */
+  async lookup(lookup, account2, ctx, self) {
+    try {
+      return lookup.extract(await this.readJson(lookup.operation, lookup.params, account2, ctx), self);
+    } catch (error2) {
+      throwIfCancelled(ctx.signal);
+      this.runtime.assertActive(ctx.signal);
+      if (GwsError.from(error2) === void 0) throw error2;
+      return void 0;
+    }
+  }
+  /** The account's own address, read with the operation's service first; undefined when no read gives it. */
+  async ownAddress(account2, service, ctx) {
+    const cached3 = this.addresses.get(account2);
+    if (cached3 && Date.now() - cached3.at < ADDRESS_TTL_MS) return cached3.address;
+    const enabled = this.runtime.config.accounts[account2]?.enabledServices ?? [];
+    const services = [.../* @__PURE__ */ new Set([service, ...Object.keys(ACCOUNT_ADDRESS_READS)])].filter((name) => Object.hasOwn(ACCOUNT_ADDRESS_READS, name) && enabled.includes(name));
+    for (const name of services) {
+      const read = ACCOUNT_ADDRESS_READS[name];
+      try {
+        const address = read.extract(await this.readJson(read.operation, read.params, account2, ctx));
+        if (address) {
+          this.addresses.set(account2, { address, at: Date.now() });
+          return address;
+        }
+      } catch (error2) {
+        throwIfCancelled(ctx.signal);
+        this.runtime.assertActive(ctx.signal);
+        if (GwsError.from(error2) === void 0) throw error2;
+      }
+    }
+    return void 0;
+  }
+  /** A field-masked read the plugin makes for itself, under the read policy; its parsed JSON. */
+  async readJson(operation, params, account2, ctx) {
+    const entry = commandIndex().methods.get(operation);
+    if (!entry) throw new GwsError("OPERATION_UNKNOWN", `'${operation}' is not in the gws manifest`);
+    const request = { account: account2, operation, params };
+    const decision = evaluatePolicy(this.runtime.config, entry, "read", request, { recipients: recipientPlan(operation, "read", request).known });
+    if (decision.effect === "deny") throw policyError(decision, account2);
+    const argv = buildCommand(entry, request, this.runtime.config, { dryRun: false, category: "read" }).argv;
+    const result = await this.accounts.run(argv, account2, operation, ctx, { scopes: entry.scopes });
+    this.runtime.assertActive(ctx.signal);
+    const parsed = parseResult(result, { maxInlineBytes: this.runtime.config.execution.maxInlineBytes });
+    if (!parsed.ok) throw processError(result, parsed, entry.service, this.accounts.remediation(account2, entry.scopes, entry.service));
+    return parsed.data;
+  }
 };
 function fileLimits(decision) {
   const { maxUploadBytes, maxDownloadBytes, readRoots, writeRoots } = decision.constraints;
@@ -11702,10 +12326,9 @@ var Runtime = class _Runtime {
     this.version = version2;
     this.binary = binary;
     this.paths = options.paths ?? pluginPaths();
-    this.workDir = mkdtempSync(join8(tmpdir(), "opencode-gws-"));
-    writeFileSync(join8(this.workDir, ".env"), "");
-    this.audit = new Audit({ ...config2.audit, path: config2.audit.path ?? join8(this.paths.stateDir, "audit.jsonl") }, options.pluginVersion);
-    this.schema = new SchemaClient(binary, this.workDir, localEnv(this.workDir, ownedDir(join8(this.paths.cacheDir, "discovery"))), config2.execution.schemaTimeoutMs);
+    this.workDir = createWorkDir();
+    this.audit = new Audit({ ...config2.audit, path: config2.audit.path ?? join9(this.paths.stateDir, "audit.jsonl") }, options.pluginVersion);
+    this.schema = new SchemaClient(binary, this.workDir, localEnv(this.workDir, ownedDir(join9(this.paths.cacheDir, "discovery"))), config2.execution.schemaTimeoutMs);
     this.accounts = new Accounts(this);
     this.operations = new Operations(this, this.accounts);
   }
@@ -11743,7 +12366,8 @@ var Runtime = class _Runtime {
   }
   static async create(config2, options) {
     const binary = resolveBinary(config2, options.projectDirectory);
-    const probeDir = mkdtempSync(join8(tmpdir(), "opencode-gws-probe-"));
+    removeStaleWorkDirs();
+    const probeDir = mkdtempSync2(join9(tmpdir2(), "opencode-gws-probe-"));
     let version2 = "unknown";
     try {
       const probe = await runProcess({
@@ -11760,7 +12384,7 @@ var Runtime = class _Runtime {
         throw new Error(`GWS_VERSION_MISMATCH: Requires ${GWS_VERSION} and the matching manifest`);
       }
     } finally {
-      rmSync(probeDir, { recursive: true, force: true });
+      rmSync2(probeDir, { recursive: true, force: true });
     }
     return new _Runtime(config2, options, binary, version2);
   }
@@ -11824,7 +12448,7 @@ var Runtime = class _Runtime {
     this.plans.invalidateAll();
     this.audit.close();
     this.closing = settled.then(() => {
-      rmSync(this.workDir, { recursive: true, force: true });
+      rmSync2(this.workDir, { recursive: true, force: true });
     });
     return this.closing;
   }
@@ -11847,8 +12471,7 @@ async function start(ctx) {
   const ids = integrationIds(config2.accounts);
   const runtime = await Runtime.create(config2, {
     pluginVersion: PLUGIN_VERSION,
-    hostVersion: host.version,
-    hostWarning: host.warning,
+    host,
     projectDirectory: ctx.location.directory,
     tokenProvider: integrationTokenProvider(ctx, config2, ids),
     connection: integrationConnection(ctx, ids),