@openclaw/google-meet 2026.7.2-beta.5 → 2026.8.1-beta.2

package/dist/{cli-GeuAaEIy.js → cli-o7RWVqDb.js}

@@ -1,16 +1,33 @@
-import { n as hasCreateSpaceConfigInput, r as resolveCreateSpaceConfig } from "./create-af1MDlus.js";
-import { a as buildGoogleMeetCalendarDayWindow, i as resolveGoogleMeetGatewayOperationTimeoutMs, o as findGoogleMeetCalendarEvent, s as listGoogleMeetCalendarEvents } from "./config-BcaS1BDr.js";
-import { _ as endGoogleMeetActiveConference, g as createGoogleMeetSpace, h as fetchGoogleMeetAttendance, m as fetchGoogleMeetArtifacts, p as buildGoogleMeetPreflightReport, v as fetchGoogleMeetSpace, y as fetchLatestGoogleMeetConferenceRecord } from "./chrome-create-DMKruRFW.js";
-import { buildGoogleMeetAuthUrl, createGoogleMeetOAuthState, createGoogleMeetPkce, exchangeGoogleMeetAuthCode, resolveGoogleMeetAccessToken, waitForGoogleMeetAuthCode } from "./oauth-DOfMKlGp.js";
-import { callGatewayFromCli } from "openclaw/plugin-sdk/gateway-runtime";
-import { clampTimerTimeoutMs, parseStrictNonNegativeInteger, parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
+import { a as resolveGoogleMeetTokenFromParams, c as buildGoogleMeetPreflightReport, d as fetchGoogleMeetSpace, f as fetchLatestGoogleMeetConferenceRecord, i as resolveArtifactQueryFromParams, l as createGoogleMeetSpace, m as listGoogleMeetCalendarEvents, n as fetchResolvedGoogleMeetAttendance, o as resolveMeetingFromParams, p as buildGoogleMeetCalendarDayWindow, s as resolveSpaceFromParams, t as fetchResolvedGoogleMeetArtifacts, u as endGoogleMeetActiveConference } from "./plugin-helpers-CfeT1SYY.js";
+import { i as resolveGoogleMeetGatewayOperationTimeoutMs } from "./config-wBK8loBb.js";
+import { buildGoogleMeetAuthUrl, exchangeGoogleMeetAuthCode, resolveGoogleMeetAccessToken, waitForGoogleMeetAuthCode } from "./oauth-9sUJ68Mw.js";
+import { n as hasCreateSpaceConfigInput, r as resolveCreateSpaceConfig } from "./create-UHeaRzsH.js";
 import { formatErrorMessage } from "openclaw/plugin-sdk/error-runtime";
+import { clampTimerTimeoutMs, parseStrictNonNegativeInteger, parseStrictPositiveInteger } from "openclaw/plugin-sdk/number-runtime";
+import { callGatewayFromCli } from "openclaw/plugin-sdk/gateway-runtime";
+import { generateHexPkceVerifierChallenge } from "openclaw/plugin-sdk/provider-auth";
+import { generateOAuthState } from "openclaw/plugin-sdk/provider-auth-runtime";
+import fsp, { writeFile } from "node:fs/promises";
 import path from "node:path";
-import { mkdir, writeFile } from "node:fs/promises";
 import JSZip from "jszip";
+import { writeExternalFileWithinRoot } from "openclaw/plugin-sdk/security-runtime";
 import { createInterface } from "node:readline/promises";
 import { format } from "node:util";
 import prettyMilliseconds from "pretty-ms";
+//#region extensions/google-meet/src/cli-command-context.ts
+function addGoogleMeetOAuthOptions(command) {
+	return command.option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds");
+}
+function addGoogleMeetMeetingOption(command) {
+	return command.option("--meeting <value>", "Meet URL, meeting code, or spaces/{id}");
+}
+function addGoogleMeetCalendarOptions(command) {
+	return command.option("--today", "Find a Meet link on today's calendar").option("--event <query>", "Find a matching calendar event with a Meet link").option("--calendar <id>", "Calendar id for --today or --event", "primary");
+}
+function addGoogleMeetArtifactOptions(command) {
+	return addGoogleMeetOAuthOptions(addGoogleMeetCalendarOptions(addGoogleMeetMeetingOption(command).option("--conference-record <name>", "Conference record name or id"))).option("--page-size <n>", "Max resources per Meet API page").option("--all-conference-records", "Fetch every conference record for --meeting");
+}
+//#endregion
 //#region extensions/google-meet/src/cli-shared.ts
 const testing = {
 	parsePositiveNumber,
@@ -20,6 +37,19 @@ const testing = {
 };
 const GOOGLE_MEET_GATEWAY_DEFAULT_TIMEOUT_MS = 5e3;
 const PLAIN_DECIMAL_NUMBER_RE = /^\d+(?:\.\d+)?$/;
+function parseGoogleMeetMode(value) {
+	if (value === void 0 || value === "agent" || value === "bidi" || value === "transcribe" || value === "realtime") return value;
+	throw new Error(`mode must be agent, bidi, transcribe, or realtime; received ${value}`);
+}
+function parseGoogleMeetTransport(value) {
+	if (value === void 0 || value === "chrome" || value === "chrome-node" || value === "twilio") return value;
+	throw new Error(`transport must be chrome, chrome-node, or twilio; received ${value}`);
+}
+function parseGoogleMeetBrowserTransport(value) {
+	const transport = parseGoogleMeetTransport(value);
+	if (transport === "twilio") throw new Error(`transport must be chrome or chrome-node; received ${value}`);
+	return transport;
+}
 function writeStdoutJson(value) {
 	process.stdout.write(`${JSON.stringify(value, null, 2)}\n`);
 }
@@ -199,7 +229,6 @@ function writeRecoverCurrentTabResult(result) {
 				toolPolicy: "safe-read-only"
 			},
 			chrome: {
-				audioBackend: "blackhole-2ch",
 				launched: true,
 				nodeId: result.nodeId,
 				health: result.browser
@@ -543,9 +572,19 @@ function googleMeetExportFileNames() {
 function defaultExportDirectory() {
 	return `google-meet-export-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
 }
+async function publishMeetExportFile(outputPath, content) {
+	const absolutePath = path.resolve(outputPath);
+	await writeExternalFileWithinRoot({
+		rootDir: path.dirname(absolutePath),
+		path: path.basename(absolutePath),
+		write: async (tempPath) => {
+			await fsp.writeFile(tempPath, content);
+		}
+	});
+}
 async function writeMeetExportBundle(params) {
 	const outputDir = params.outputDir?.trim() || defaultExportDirectory();
-	await mkdir(outputDir, { recursive: true });
+	await fsp.mkdir(outputDir, { recursive: true });
 	const zipFile = params.zip ? `${outputDir.replace(/\/$/, "")}.zip` : void 0;
 	const fileNames = googleMeetExportFileNames();
 	const files = [
@@ -582,7 +621,7 @@ async function writeMeetExportBundle(params) {
 			}), null, 2)}\n`
 		}
 	];
-	for (const file of files) await writeFile(path.join(outputDir, file.name), file.content, "utf8");
+	for (const file of files) await publishMeetExportFile(path.join(outputDir, file.name), file.content);
 	const result = {
 		outputDir,
 		files: files.map((file) => path.join(outputDir, file.name))
@@ -590,38 +629,31 @@ async function writeMeetExportBundle(params) {
 	if (zipFile) {
 		const zip = new JSZip();
 		for (const file of files) zip.file(file.name, file.content);
-		await writeFile(zipFile, await zip.generateAsync({ type: "nodebuffer" }));
+		await publishMeetExportFile(zipFile, await zip.generateAsync({ type: "nodebuffer" }));
 		result.zipFile = zipFile;
 	}
 	return result;
 }
 //#endregion
 //#region extensions/google-meet/src/cli-artifact-commands.ts
+async function resolveCliArtifactQuery(context, options) {
+	const { lateAfterMinutes, earlyBeforeMinutes, ...raw } = context.resolveCliArtifactParams(options);
+	return {
+		...await resolveArtifactQueryFromParams(context.config, raw),
+		lateAfterMinutes,
+		earlyBeforeMinutes
+	};
+}
 function registerGoogleMeetArtifactCommands(context) {
 	const params = context;
-	const { root, resolveArtifactTokenOptions, resolveMeetingForToken } = context;
-	root.command("artifacts").description("List Meet conference records and available participant/artifact metadata").option("--meeting <value>", "Meet URL, meeting code, or spaces/{id}").option("--conference-record <name>", "Conference record name or id").option("--today", "Find a Meet link on today's calendar").option("--event <query>", "Find a matching calendar event with a Meet link").option("--calendar <id>", "Calendar id for --today or --event", "primary").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--page-size <n>", "Max resources per Meet API page").option("--all-conference-records", "Fetch every conference record for --meeting").option("--no-transcript-entries", "Skip structured transcript entry lookup").option("--include-doc-bodies", "Export linked transcript and smart-note Google Docs text").option("--format <format>", "Output format: summary or markdown", "summary").option("--output <path>", "Write output to a file instead of stdout").option("--json", "Print JSON output", false).action(async (options) => {
-		const resolved = resolveArtifactTokenOptions(params.config, options);
-		const token = await resolveGoogleMeetAccessToken(resolved);
-		const meeting = resolved.conferenceRecord ? resolved.meeting : (await resolveMeetingForToken({
-			config: params.config,
-			options,
-			accessToken: token.accessToken,
-			configuredMeeting: resolved.meeting
-		})).meeting;
-		const result = await fetchGoogleMeetArtifacts({
-			accessToken: token.accessToken,
-			meeting,
-			conferenceRecord: resolved.conferenceRecord,
-			pageSize: resolved.pageSize,
-			includeTranscriptEntries: resolved.includeTranscriptEntries,
-			allConferenceRecords: resolved.allConferenceRecords,
-			includeDocumentBodies: resolved.includeDocumentBodies
-		});
+	const { root } = context;
+	addGoogleMeetArtifactOptions(root.command("artifacts").description("List Meet conference records and available participant/artifact metadata")).option("--no-transcript-entries", "Skip structured transcript entry lookup").option("--include-doc-bodies", "Export linked transcript and smart-note Google Docs text").option("--format <format>", "Output format: summary or markdown", "summary").option("--output <path>", "Write output to a file instead of stdout").option("--json", "Print JSON output", false).action(async (options) => {
+		const resolved = await resolveCliArtifactQuery(params, options);
+		const result = await fetchResolvedGoogleMeetArtifacts(resolved);
 		if (options.json) {
 			await writeCliOutput(options, JSON.stringify({
 				...result,
-				tokenSource: token.refreshed ? "refresh-token" : "cached-access-token"
+				tokenSource: resolved.token.refreshed ? "refresh-token" : "cached-access-token"
 			}, null, 2));
 			return;
 		}
@@ -631,31 +663,15 @@ function registerGoogleMeetArtifactCommands(context) {
 		}
 		if (options.format && options.format !== "summary") throw new Error("Unsupported format. Expected summary or markdown.");
 		writeArtifactsSummary(result);
-		writeStdoutLine("token source: %s", token.refreshed ? "refresh-token" : "cached-access-token");
+		writeStdoutLine("token source: %s", resolved.token.refreshed ? "refresh-token" : "cached-access-token");
 	});
-	root.command("attendance").description("List Meet participants and participant sessions").option("--meeting <value>", "Meet URL, meeting code, or spaces/{id}").option("--conference-record <name>", "Conference record name or id").option("--today", "Find a Meet link on today's calendar").option("--event <query>", "Find a matching calendar event with a Meet link").option("--calendar <id>", "Calendar id for --today or --event", "primary").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--page-size <n>", "Max resources per Meet API page").option("--all-conference-records", "Fetch every conference record for --meeting").option("--no-merge-duplicates", "Keep duplicate participant resources as separate rows").option("--late-after-minutes <n>", "Mark participants late after this many minutes", "5").option("--early-before-minutes <n>", "Mark early leavers before this many minutes", "5").option("--format <format>", "Output format: summary, markdown, or csv", "summary").option("--output <path>", "Write output to a file instead of stdout").option("--json", "Print JSON output", false).action(async (options) => {
-		const resolved = resolveArtifactTokenOptions(params.config, options);
-		const token = await resolveGoogleMeetAccessToken(resolved);
-		const meeting = resolved.conferenceRecord ? resolved.meeting : (await resolveMeetingForToken({
-			config: params.config,
-			options,
-			accessToken: token.accessToken,
-			configuredMeeting: resolved.meeting
-		})).meeting;
-		const result = await fetchGoogleMeetAttendance({
-			accessToken: token.accessToken,
-			meeting,
-			conferenceRecord: resolved.conferenceRecord,
-			pageSize: resolved.pageSize,
-			allConferenceRecords: resolved.allConferenceRecords,
-			mergeDuplicateParticipants: resolved.mergeDuplicateParticipants,
-			lateAfterMinutes: resolved.lateAfterMinutes,
-			earlyBeforeMinutes: resolved.earlyBeforeMinutes
-		});
+	addGoogleMeetArtifactOptions(root.command("attendance").description("List Meet participants and participant sessions")).option("--no-merge-duplicates", "Keep duplicate participant resources as separate rows").option("--late-after-minutes <n>", "Mark participants late after this many minutes", "5").option("--early-before-minutes <n>", "Mark early leavers before this many minutes", "5").option("--format <format>", "Output format: summary, markdown, or csv", "summary").option("--output <path>", "Write output to a file instead of stdout").option("--json", "Print JSON output", false).action(async (options) => {
+		const resolved = await resolveCliArtifactQuery(params, options);
+		const result = await fetchResolvedGoogleMeetAttendance(resolved);
 		if (options.json) {
 			await writeCliOutput(options, JSON.stringify({
 				...result,
-				tokenSource: token.refreshed ? "refresh-token" : "cached-access-token"
+				tokenSource: resolved.token.refreshed ? "refresh-token" : "cached-access-token"
 			}, null, 2));
 			return;
 		}
@@ -669,42 +685,17 @@ function registerGoogleMeetArtifactCommands(context) {
 		}
 		if (options.format && options.format !== "summary") throw new Error("Unsupported format. Expected summary, markdown, or csv.");
 		writeAttendanceSummary(result);
-		writeStdoutLine("token source: %s", token.refreshed ? "refresh-token" : "cached-access-token");
+		writeStdoutLine("token source: %s", resolved.token.refreshed ? "refresh-token" : "cached-access-token");
 	});
-	root.command("export").description("Write Meet artifacts, attendance, transcript, and raw JSON into a folder").option("--meeting <value>", "Meet URL, meeting code, or spaces/{id}").option("--conference-record <name>", "Conference record name or id").option("--today", "Find a Meet link on today's calendar").option("--event <query>", "Find a matching calendar event with a Meet link").option("--calendar <id>", "Calendar id for --today or --event", "primary").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--page-size <n>", "Max resources per Meet API page").option("--all-conference-records", "Fetch every conference record for --meeting").option("--no-transcript-entries", "Skip structured transcript entry lookup").option("--include-doc-bodies", "Export linked transcript and smart-note Google Docs text").option("--no-merge-duplicates", "Keep duplicate participant resources as separate rows").option("--late-after-minutes <n>", "Mark participants late after this many minutes", "5").option("--early-before-minutes <n>", "Mark early leavers before this many minutes", "5").option("--output <dir>", "Output directory").option("--zip", "Also write a portable .zip archive").option("--dry-run", "Fetch export data and print the manifest without writing files", false).option("--json", "Print JSON output", false).action(async (options) => {
-		const resolved = resolveArtifactTokenOptions(params.config, options);
-		const token = await resolveGoogleMeetAccessToken(resolved);
-		const meetingResult = resolved.conferenceRecord ? { meeting: resolved.meeting } : await resolveMeetingForToken({
-			config: params.config,
-			options,
-			accessToken: token.accessToken,
-			configuredMeeting: resolved.meeting
-		});
-		const artifacts = await fetchGoogleMeetArtifacts({
-			accessToken: token.accessToken,
-			meeting: meetingResult.meeting,
-			conferenceRecord: resolved.conferenceRecord,
-			pageSize: resolved.pageSize,
-			includeTranscriptEntries: resolved.includeTranscriptEntries,
-			allConferenceRecords: resolved.allConferenceRecords,
-			includeDocumentBodies: resolved.includeDocumentBodies
-		});
-		const attendance = await fetchGoogleMeetAttendance({
-			accessToken: token.accessToken,
-			meeting: meetingResult.meeting,
-			conferenceRecord: resolved.conferenceRecord,
-			pageSize: resolved.pageSize,
-			allConferenceRecords: resolved.allConferenceRecords,
-			mergeDuplicateParticipants: resolved.mergeDuplicateParticipants,
-			lateAfterMinutes: resolved.lateAfterMinutes,
-			earlyBeforeMinutes: resolved.earlyBeforeMinutes
-		});
-		const resolvedMeeting = meetingResult.meeting ?? resolved.meeting;
+	addGoogleMeetArtifactOptions(root.command("export").description("Write Meet artifacts, attendance, transcript, and raw JSON into a folder")).option("--no-transcript-entries", "Skip structured transcript entry lookup").option("--include-doc-bodies", "Export linked transcript and smart-note Google Docs text").option("--no-merge-duplicates", "Keep duplicate participant resources as separate rows").option("--late-after-minutes <n>", "Mark participants late after this many minutes", "5").option("--early-before-minutes <n>", "Mark early leavers before this many minutes", "5").option("--output <dir>", "Output directory").option("--zip", "Also write a portable .zip archive").option("--dry-run", "Fetch export data and print the manifest without writing files", false).option("--json", "Print JSON output", false).action(async (options) => {
+		const resolved = await resolveCliArtifactQuery(params, options);
+		const artifacts = await fetchResolvedGoogleMeetArtifacts(resolved);
+		const attendance = await fetchResolvedGoogleMeetAttendance(resolved);
 		const request = {
-			...resolvedMeeting ? { meeting: resolvedMeeting } : {},
+			...resolved.meeting ? { meeting: resolved.meeting } : {},
 			...resolved.conferenceRecord ? { conferenceRecord: resolved.conferenceRecord } : {},
-			...meetingResult.calendarEvent?.event.id ? { calendarEventId: meetingResult.calendarEvent.event.id } : {},
-			...meetingResult.calendarEvent?.event.summary ? { calendarEventSummary: meetingResult.calendarEvent.event.summary } : {},
+			...resolved.calendarEvent?.event.id ? { calendarEventId: resolved.calendarEvent.event.id } : {},
+			...resolved.calendarEvent?.event.summary ? { calendarEventSummary: resolved.calendarEvent.event.summary } : {},
 			...options.calendar ? { calendarId: options.calendar } : {},
 			...resolved.pageSize !== void 0 ? { pageSize: resolved.pageSize } : {},
 			includeTranscriptEntries: resolved.includeTranscriptEntries,
@@ -722,11 +713,11 @@ function registerGoogleMeetArtifactCommands(context) {
 					attendance,
 					files: googleMeetExportFileNames(),
 					request,
-					tokenSource: token.refreshed ? "refresh-token" : "cached-access-token",
-					...meetingResult.calendarEvent ? { calendarEvent: meetingResult.calendarEvent } : {}
+					tokenSource: resolved.token.refreshed ? "refresh-token" : "cached-access-token",
+					...resolved.calendarEvent ? { calendarEvent: resolved.calendarEvent } : {}
 				}),
-				...meetingResult.calendarEvent ? { calendarEvent: meetingResult.calendarEvent } : {},
-				tokenSource: token.refreshed ? "refresh-token" : "cached-access-token"
+				...resolved.calendarEvent ? { calendarEvent: resolved.calendarEvent } : {},
+				tokenSource: resolved.token.refreshed ? "refresh-token" : "cached-access-token"
 			});
 			return;
 		}
@@ -736,13 +727,13 @@ function registerGoogleMeetArtifactCommands(context) {
 			attendance,
 			zip: Boolean(options.zip),
 			request,
-			tokenSource: token.refreshed ? "refresh-token" : "cached-access-token",
-			...meetingResult.calendarEvent ? { calendarEvent: meetingResult.calendarEvent } : {}
+			tokenSource: resolved.token.refreshed ? "refresh-token" : "cached-access-token",
+			...resolved.calendarEvent ? { calendarEvent: resolved.calendarEvent } : {}
 		});
 		const payload = {
 			...bundle,
-			...meetingResult.calendarEvent ? { calendarEvent: meetingResult.calendarEvent } : {},
-			tokenSource: token.refreshed ? "refresh-token" : "cached-access-token"
+			...resolved.calendarEvent ? { calendarEvent: resolved.calendarEvent } : {},
+			tokenSource: resolved.token.refreshed ? "refresh-token" : "cached-access-token"
 		};
 		if (options.json) {
 			writeStdoutJson(payload);
@@ -904,8 +895,8 @@ function registerGoogleMeetProbeCommands(context) {
 	root.command("join").argument("[url]", "Explicit https://meet.google.com/... URL").option("--transport <transport>", "Transport: chrome, chrome-node, or twilio").option("--mode <mode>", "Mode: agent, bidi, or transcribe").option("--message <text>", "Realtime speech to trigger after join").option("--dial-in-number <phone>", "Meet dial-in number for Twilio transport").option("--pin <pin>", "Meet phone PIN; # is appended if omitted").option("--dtmf-sequence <sequence>", "Explicit Twilio DTMF sequence").action(async (url, options) => {
 		const payload = {
 			url: resolveMeetingInput(params.config, url),
-			transport: options.transport,
-			mode: options.mode,
+			transport: parseGoogleMeetTransport(options.transport),
+			mode: parseGoogleMeetMode(options.mode),
 			message: options.message,
 			dialInNumber: options.dialInNumber,
 			pin: options.pin,
@@ -927,8 +918,8 @@ function registerGoogleMeetProbeCommands(context) {
 	root.command("test-speech").argument("[url]", "Explicit https://meet.google.com/... URL").option("--transport <transport>", "Transport: chrome, chrome-node, or twilio").option("--mode <mode>", "Mode: agent, bidi, or transcribe").option("--message <text>", "Realtime speech to trigger", "Say exactly: Google Meet speech test complete.").action(async (url, options) => {
 		const payload = {
 			url: resolveMeetingInput(params.config, url),
-			transport: options.transport,
-			mode: options.mode,
+			transport: parseGoogleMeetTransport(options.transport),
+			mode: parseGoogleMeetMode(options.mode),
 			message: options.message
 		};
 		const delegated = await callGoogleMeetGateway({
@@ -946,7 +937,7 @@ function registerGoogleMeetProbeCommands(context) {
 	root.command("test-listen").argument("[url]", "Explicit https://meet.google.com/... URL").option("--transport <transport>", "Transport: chrome or chrome-node").option("--timeout-ms <ms>", "How long to wait for fresh captions/transcript movement").action(async (url, options) => {
 		const payload = {
 			url: resolveMeetingInput(params.config, url),
-			transport: options.transport,
+			transport: parseGoogleMeetBrowserTransport(options.transport),
 			timeoutMs: parsePositiveNumber(options.timeoutMs, "timeout-ms")
 		};
 		const delegated = await callGoogleMeetGateway({
@@ -1006,7 +997,7 @@ function registerGoogleMeetLifecycleCommands(context) {
 	root.command("recover-tab").description("Focus and inspect an existing Google Meet tab").argument("[url]", "Optional Meet URL to match").option("--transport <transport>", "Transport to inspect: chrome or chrome-node").option("--json", "Print JSON output", false).action(async (url, options) => {
 		const result = await (await params.ensureRuntime()).recoverCurrentTab({
 			url,
-			transport: options.transport
+			transport: parseGoogleMeetBrowserTransport(options.transport)
 		});
 		if (options.json) {
 			writeStdoutJson(result);
@@ -1016,14 +1007,16 @@ function registerGoogleMeetLifecycleCommands(context) {
 	});
 	root.command("setup").description("Show Google Meet transport setup status").option("--transport <transport>", "Transport to check: chrome, chrome-node, or twilio").option("--mode <mode>", "Mode to check: agent, bidi, or transcribe").option("--json", "Print JSON output", false).action(async (options) => {
 		const status = await (await params.ensureRuntime()).setupStatus({
-			transport: options.transport,
-			mode: options.mode
+			transport: parseGoogleMeetTransport(options.transport),
+			mode: parseGoogleMeetMode(options.mode)
 		});
 		if (options.json) {
 			writeStdoutJson(status);
+			if (!status.ok) process.exitCode = 1;
 			return;
 		}
 		writeSetupStatus(status);
+		if (!status.ok) process.exitCode = 1;
 	});
 	root.command("leave").argument("<session-id>", "Meet session ID").action(async (sessionId) => {
 		const delegated = await callGoogleMeetGateway({
@@ -1065,10 +1058,24 @@ function registerGoogleMeetLifecycleCommands(context) {
 }
 //#endregion
 //#region extensions/google-meet/src/cli-space-commands.ts
+function writeGoogleMeetCreateOutput(payload, json) {
+	if (json) {
+		writeStdoutJson(payload);
+		return;
+	}
+	writeStdoutLine("meeting uri: %s", payload.meetingUri);
+	if (payload.space?.name) writeStdoutLine("space: %s", payload.space.name);
+	if (payload.space?.meetingCode) writeStdoutLine("meeting code: %s", payload.space.meetingCode);
+	if (payload.source) writeStdoutLine("source: %s", payload.source);
+	if (payload.browser?.nodeId) writeStdoutLine("node: %s", payload.browser.nodeId);
+	if (payload.tokenSource) writeStdoutLine("token source: %s", payload.tokenSource);
+	const joinedSessionId = payload.joined ? payload.join?.session?.id : void 0;
+	writeStdoutLine(joinedSessionId ? "joined: %s" : "joined: no (run `openclaw googlemeet join %s`)", joinedSessionId ?? payload.meetingUri);
+}
 function registerGoogleMeetCreateCommands(context) {
 	const params = context;
-	const { root, callGateway, operationTimeoutMs, hasCreateOAuth, resolveCreateTokenOptions, resolveMeetingInput, resolveOAuthTokenOptions } = context;
-	root.command("create").description("Create a new Google Meet space and print its meeting URL").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--access-type <type>", "Google Meet SpaceConfig accessType for API create: OPEN, TRUSTED, or RESTRICTED").option("--entry-point-access <type>", "Google Meet SpaceConfig entryPointAccess for API create: ALL or CREATOR_APP_ONLY").option("--no-join", "Only create the meeting URL; do not join it").option("--transport <transport>", "Join transport: chrome, chrome-node, or twilio").option("--mode <mode>", "Join mode: agent, bidi, or transcribe").option("--message <text>", "Realtime speech to trigger after join").option("--dial-in-number <phone>", "Meet dial-in number for Twilio transport").option("--pin <pin>", "Meet phone PIN; # is appended if omitted").option("--dtmf-sequence <sequence>", "Explicit Twilio DTMF sequence").option("--json", "Print JSON output", false).action(async (options) => {
+	const { root, callGateway, operationTimeoutMs, hasCreateOAuth, resolveMeetingInput, resolveCliParams } = context;
+	addGoogleMeetOAuthOptions(root.command("create").description("Create a new Google Meet space and print its meeting URL")).option("--access-type <type>", "Google Meet SpaceConfig accessType for API create: OPEN, TRUSTED, or RESTRICTED").option("--entry-point-access <type>", "Google Meet SpaceConfig entryPointAccess for API create: ALL or CREATOR_APP_ONLY").option("--no-join", "Only create the meeting URL; do not join it").option("--transport <transport>", "Join transport: chrome, chrome-node, or twilio").option("--mode <mode>", "Join mode: agent, bidi, or transcribe").option("--message <text>", "Realtime speech to trigger after join").option("--dial-in-number <phone>", "Meet dial-in number for Twilio transport").option("--pin <pin>", "Meet phone PIN; # is appended if omitted").option("--dtmf-sequence <sequence>", "Explicit Twilio DTMF sequence").option("--json", "Print JSON output", false).action(async (options) => {
 		if (options.join !== false) {
 			const delegated = await callGoogleMeetGateway({
 				callGateway,
@@ -1078,18 +1085,7 @@ function registerGoogleMeetCreateCommands(context) {
 			});
 			if (delegated.ok) {
 				const payload = delegated.payload;
-				if (options.json) {
-					writeStdoutJson(payload);
-					return;
-				}
-				writeStdoutLine("meeting uri: %s", payload.meetingUri);
-				if (payload.space?.name) writeStdoutLine("space: %s", payload.space.name);
-				if (payload.space?.meetingCode) writeStdoutLine("meeting code: %s", payload.space.meetingCode);
-				if (payload.source) writeStdoutLine("source: %s", payload.source);
-				if (payload.browser?.nodeId) writeStdoutLine("node: %s", payload.browser.nodeId);
-				if (payload.tokenSource) writeStdoutLine("token source: %s", payload.tokenSource);
-				if (payload.joined && payload.join?.session?.id) writeStdoutLine("joined: %s", payload.join.session.id);
-				else writeStdoutLine("joined: no (run `openclaw googlemeet join %s`)", payload.meetingUri);
+				writeGoogleMeetCreateOutput(payload, options.json);
 				return;
 			}
 		}
@@ -1099,14 +1095,14 @@ function registerGoogleMeetCreateCommands(context) {
 			const result = await rt.createViaBrowser();
 			const join = options.join !== false ? await rt.join({
 				url: result.meetingUri,
-				transport: options.transport,
-				mode: options.mode,
+				transport: parseGoogleMeetTransport(options.transport),
+				mode: parseGoogleMeetMode(options.mode),
 				message: options.message,
 				dialInNumber: options.dialInNumber,
 				pin: options.pin,
 				dtmfSequence: options.dtmfSequence
 			}) : void 0;
-			const payload = {
+			writeGoogleMeetCreateOutput({
 				source: result.source,
 				meetingUri: result.meetingUri,
 				joined: Boolean(join),
@@ -1117,50 +1113,32 @@ function registerGoogleMeetCreateCommands(context) {
 					browserUrl: result.browserUrl,
 					browserTitle: result.browserTitle
 				}
-			};
-			if (options.json) {
-				writeStdoutJson(payload);
-				return;
-			}
-			writeStdoutLine("meeting uri: %s", result.meetingUri);
-			writeStdoutLine("source: browser");
-			writeStdoutLine("node: %s", result.nodeId);
-			if (join) writeStdoutLine("joined: %s", join.session.id);
-			else writeStdoutLine("joined: no (run `openclaw googlemeet join %s`)", result.meetingUri);
+			}, options.json);
 			return;
 		}
-		const token = await resolveGoogleMeetAccessToken(resolveCreateTokenOptions(params.config, options));
+		const token = await resolveGoogleMeetTokenFromParams(params.config, resolveCliParams(options));
 		const result = await createGoogleMeetSpace({
 			accessToken: token.accessToken,
 			config: resolveCreateSpaceConfig(options)
 		});
 		const join = options.join !== false ? await (await params.ensureRuntime()).join({
 			url: result.meetingUri,
-			transport: options.transport,
-			mode: options.mode,
+			transport: parseGoogleMeetTransport(options.transport),
+			mode: parseGoogleMeetMode(options.mode),
 			message: options.message,
 			dialInNumber: options.dialInNumber,
 			pin: options.pin,
 			dtmfSequence: options.dtmfSequence
 		}) : void 0;
-		if (options.json) {
-			writeStdoutJson({
-				...result,
-				tokenSource: token.refreshed ? "refresh-token" : "cached-access-token",
-				joined: Boolean(join),
-				...join ? { join } : {}
-			});
-			return;
-		}
-		writeStdoutLine("meeting uri: %s", result.meetingUri);
-		writeStdoutLine("space: %s", result.space.name);
-		if (result.space.meetingCode) writeStdoutLine("meeting code: %s", result.space.meetingCode);
-		writeStdoutLine("token source: %s", token.refreshed ? "refresh-token" : "cached-access-token");
-		if (join) writeStdoutLine("joined: %s", join.session.id);
-		else writeStdoutLine("joined: no (run `openclaw googlemeet join %s`)", result.meetingUri);
+		writeGoogleMeetCreateOutput({
+			...result,
+			tokenSource: token.refreshed ? "refresh-token" : "cached-access-token",
+			joined: Boolean(join),
+			...join ? { join } : {}
+		}, options.json);
 	});
-	root.command("end-active-conference").description("End the active conference for a Google Meet space").argument("[meeting]", "Meet URL, meeting code, or spaces/{id}").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--json", "Print JSON output", false).action(async (meeting, options) => {
-		const token = await resolveGoogleMeetAccessToken(resolveOAuthTokenOptions(params.config, options));
+	addGoogleMeetOAuthOptions(root.command("end-active-conference").description("End the active conference for a Google Meet space").argument("[meeting]", "Meet URL, meeting code, or spaces/{id}")).option("--json", "Print JSON output", false).action(async (meeting, options) => {
+		const token = await resolveGoogleMeetTokenFromParams(params.config, resolveCliParams(options));
 		const result = await endGoogleMeetActiveConference({
 			accessToken: token.accessToken,
 			meeting: resolveMeetingInput(params.config, meeting ?? options.meeting)
@@ -1179,34 +1157,32 @@ function registerGoogleMeetCreateCommands(context) {
 }
 function registerGoogleMeetApiCommands(context) {
 	const params = context;
-	const { root, resolveMeetingForToken, resolveOAuthTokenOptions, resolveTokenOptions } = context;
-	root.command("resolve-space").description("Resolve a Meet URL, meeting code, or spaces/{id} to its canonical space").option("--meeting <value>", "Meet URL, meeting code, or spaces/{id}").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--json", "Print JSON output", false).action(async (options) => {
-		const resolved = resolveTokenOptions(params.config, options);
-		const token = await resolveGoogleMeetAccessToken(resolved);
-		const space = await fetchGoogleMeetSpace({
-			accessToken: token.accessToken,
-			meeting: resolved.meeting
+	const { root, resolveCliParams, resolveMeetingInput } = context;
+	addGoogleMeetOAuthOptions(addGoogleMeetMeetingOption(root.command("resolve-space").description("Resolve a Meet URL, meeting code, or spaces/{id} to its canonical space"))).option("--json", "Print JSON output", false).action(async (options) => {
+		const meeting = resolveMeetingInput(params.config, options.meeting);
+		const { space, token } = await resolveSpaceFromParams(params.config, {
+			...resolveCliParams(options),
+			meeting
 		});
 		if (options.json) {
 			writeStdoutJson(space);
 			return;
 		}
-		writeStdoutLine("input: %s", resolved.meeting);
+		writeStdoutLine("input: %s", meeting);
 		writeStdoutLine("space: %s", space.name);
 		if (space.meetingCode) writeStdoutLine("meeting code: %s", space.meetingCode);
 		if (space.meetingUri) writeStdoutLine("meeting uri: %s", space.meetingUri);
 		writeStdoutLine("active conference: %s", space.activeConference ? "yes" : "no");
 		writeStdoutLine("token source: %s", token.refreshed ? "refresh-token" : "cached-access-token");
 	});
-	root.command("preflight").description("Validate OAuth + meeting resolution prerequisites for Meet media work").option("--meeting <value>", "Meet URL, meeting code, or spaces/{id}").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--json", "Print JSON output", false).action(async (options) => {
-		const resolved = resolveTokenOptions(params.config, options);
-		const token = await resolveGoogleMeetAccessToken(resolved);
-		const space = await fetchGoogleMeetSpace({
-			accessToken: token.accessToken,
-			meeting: resolved.meeting
+	addGoogleMeetOAuthOptions(addGoogleMeetMeetingOption(root.command("preflight").description("Validate OAuth + meeting resolution prerequisites for Meet media work"))).option("--json", "Print JSON output", false).action(async (options) => {
+		const meeting = resolveMeetingInput(params.config, options.meeting);
+		const { space, token } = await resolveSpaceFromParams(params.config, {
+			...resolveCliParams(options),
+			meeting
 		});
 		const report = buildGoogleMeetPreflightReport({
-			input: resolved.meeting,
+			input: meeting,
 			space,
 			previewAcknowledged: params.config.preview.enrollmentAcknowledged,
 			tokenSource: token.refreshed ? "refresh-token" : "cached-access-token"
@@ -1229,13 +1205,18 @@ function registerGoogleMeetApiCommands(context) {
 		writeStdoutLine("blockers:");
 		for (const blocker of report.blockers) writeStdoutLine("- %s", blocker);
 	});
-	root.command("latest").description("Find the latest Meet conference record for a meeting").option("--meeting <value>", "Meet URL, meeting code, or spaces/{id}").option("--today", "Find a Meet link on today's calendar").option("--event <query>", "Find a matching calendar event with a Meet link").option("--calendar <id>", "Calendar id for --today or --event", "primary").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--json", "Print JSON output", false).action(async (options) => {
-		const token = await resolveGoogleMeetAccessToken(resolveOAuthTokenOptions(params.config, options));
-		const resolved = await resolveMeetingForToken({
+	addGoogleMeetOAuthOptions(addGoogleMeetCalendarOptions(addGoogleMeetMeetingOption(root.command("latest").description("Find the latest Meet conference record for a meeting")))).option("--json", "Print JSON output", false).action(async (options) => {
+		const raw = resolveCliParams(options);
+		const token = await resolveGoogleMeetTokenFromParams(params.config, raw);
+		if (!options.today && !options.event?.trim()) {
+			const meeting = options.meeting?.trim() || params.config.defaults.meeting;
+			if (!meeting) throw new Error("Meeting input is required. Pass --meeting, --today, --event, or configure defaults.meeting.");
+			raw.meeting = meeting;
+		}
+		const resolved = await resolveMeetingFromParams({
 			config: params.config,
-			options,
-			accessToken: token.accessToken,
-			configuredMeeting: options.meeting?.trim()
+			raw,
+			accessToken: token.accessToken
 		});
 		const result = await fetchLatestGoogleMeetConferenceRecord({
 			accessToken: token.accessToken,
@@ -1257,7 +1238,7 @@ function registerGoogleMeetApiCommands(context) {
 		writeStdoutLine("token source: %s", token.refreshed ? "refresh-token" : "cached-access-token");
 	});
 	root.command("calendar-events").description("Preview Calendar events with Google Meet links").option("--today", "Find Meet links on today's calendar").option("--event <query>", "Find matching calendar events with Meet links").option("--calendar <id>", "Calendar id for lookup", "primary").option("--access-token <token>", "Access token override").option("--refresh-token <token>", "Refresh token override").option("--client-id <id>", "OAuth client id override").option("--client-secret <secret>", "OAuth client secret override").option("--expires-at <ms>", "Cached access token expiry as unix epoch milliseconds").option("--json", "Print JSON output", false).action(async (options) => {
-		const token = await resolveGoogleMeetAccessToken(resolveOAuthTokenOptions(params.config, options));
+		const token = await resolveGoogleMeetTokenFromParams(params.config, resolveCliParams(options));
 		const window = options.today ? buildGoogleMeetCalendarDayWindow() : {};
 		const result = await listGoogleMeetCalendarEvents({
 			accessToken: token.accessToken,
@@ -1284,76 +1265,30 @@ function resolveMeetingInput(config, value) {
 	if (!meeting) throw new Error("Meeting input is required. Pass a URL/meeting code or configure defaults.meeting.");
 	return meeting;
 }
-function resolveOAuthTokenOptions(config, options) {
-	return {
-		clientId: options.clientId?.trim() || config.oauth.clientId,
-		clientSecret: options.clientSecret?.trim() || config.oauth.clientSecret,
-		refreshToken: options.refreshToken?.trim() || config.oauth.refreshToken,
-		accessToken: options.accessToken?.trim() || config.oauth.accessToken,
-		expiresAt: parseOptionalNumber(options.expiresAt) ?? config.oauth.expiresAt
-	};
-}
-function resolveTokenOptions(config, options) {
-	return {
-		meeting: resolveMeetingInput(config, options.meeting),
-		...resolveOAuthTokenOptions(config, options)
-	};
-}
 function hasCalendarLookupOptions(options) {
 	return Boolean(options.today || options.event?.trim());
 }
-async function resolveCalendarMeetingInput(params) {
-	if (!hasCalendarLookupOptions(params.options)) return {};
-	const window = params.options.today ? buildGoogleMeetCalendarDayWindow() : {};
-	const calendarEvent = await findGoogleMeetCalendarEvent({
-		accessToken: params.accessToken,
-		calendarId: params.options.calendar,
-		eventQuery: params.options.event,
-		...window
-	});
-	return {
-		meeting: calendarEvent.meetingUri,
-		calendarEvent
-	};
-}
-async function resolveMeetingForToken(params) {
-	const calendarMeeting = await resolveCalendarMeetingInput({
-		accessToken: params.accessToken,
-		options: params.options
-	});
-	const meeting = calendarMeeting.meeting ?? params.configuredMeeting ?? params.config.defaults.meeting;
-	if (!meeting) throw new Error("Meeting input is required. Pass --meeting, --today, --event, or configure defaults.meeting.");
-	return calendarMeeting.calendarEvent ? {
-		meeting,
-		calendarEvent: calendarMeeting.calendarEvent
-	} : { meeting };
-}
-function resolveCreateTokenOptions(config, options) {
+function resolveCliParams(options) {
+	const { calendar, expiresAt, ...raw } = options;
 	return {
-		clientId: options.clientId?.trim() || config.oauth.clientId,
-		clientSecret: options.clientSecret?.trim() || config.oauth.clientSecret,
-		refreshToken: options.refreshToken?.trim() || config.oauth.refreshToken,
-		accessToken: options.accessToken?.trim() || config.oauth.accessToken,
-		expiresAt: parseOptionalNumber(options.expiresAt) ?? config.oauth.expiresAt
+		...raw,
+		calendarId: calendar,
+		expiresAt: parseOptionalNumber(expiresAt)
 	};
 }
-function resolveArtifactTokenOptions(config, options) {
+function resolveCliArtifactParams(config, options) {
 	const meeting = options.meeting?.trim() || config.defaults.meeting;
 	const conferenceRecord = options.conferenceRecord?.trim();
 	if (!meeting && !conferenceRecord && !hasCalendarLookupOptions(options)) throw new Error("Meeting input or conference record is required. Pass --meeting, --today, --event, --conference-record, or configure defaults.meeting.");
 	return {
+		...resolveCliParams(options),
 		meeting,
 		conferenceRecord,
-		clientId: options.clientId?.trim() || config.oauth.clientId,
-		clientSecret: options.clientSecret?.trim() || config.oauth.clientSecret,
-		refreshToken: options.refreshToken?.trim() || config.oauth.refreshToken,
-		accessToken: options.accessToken?.trim() || config.oauth.accessToken,
-		expiresAt: parseOptionalNumber(options.expiresAt) ?? config.oauth.expiresAt,
 		pageSize: parsePositiveIntegerOption(options.pageSize, "page-size"),
-		includeTranscriptEntries: options.transcriptEntries !== false,
-		allConferenceRecords: Boolean(options.allConferenceRecords),
-		includeDocumentBodies: Boolean(options.includeDocBodies),
-		mergeDuplicateParticipants: options.mergeDuplicates !== false,
+		includeTranscriptEntries: options.transcriptEntries,
+		includeAllConferenceRecords: options.allConferenceRecords,
+		includeDocumentBodies: options.includeDocBodies,
+		mergeDuplicateParticipants: options.mergeDuplicates,
 		lateAfterMinutes: parseOptionalNumber(options.lateAfterMinutes),
 		earlyBeforeMinutes: parseOptionalNumber(options.earlyBeforeMinutes)
 	};
@@ -1369,8 +1304,8 @@ function registerGoogleMeetCli(params) {
 		const clientId = options.clientId?.trim() || params.config.oauth.clientId;
 		const clientSecret = options.clientSecret?.trim() || params.config.oauth.clientSecret;
 		if (!clientId) throw new Error("Missing Google Meet OAuth client id. Configure oauth.clientId or pass --client-id.");
-		const { verifier, challenge } = createGoogleMeetPkce();
-		const state = createGoogleMeetOAuthState();
+		const { verifier, challenge } = generateHexPkceVerifierChallenge();
+		const state = generateOAuthState();
 		const authUrl = buildGoogleMeetAuthUrl({
 			clientId,
 			challenge,
@@ -1411,11 +1346,8 @@ function registerGoogleMeetCli(params) {
 		callGateway,
 		operationTimeoutMs,
 		resolveMeetingInput,
-		resolveOAuthTokenOptions,
-		resolveTokenOptions,
-		resolveMeetingForToken,
-		resolveCreateTokenOptions,
-		resolveArtifactTokenOptions,
+		resolveCliParams,
+		resolveCliArtifactParams: (options) => resolveCliArtifactParams(params.config, options),
 		hasCreateOAuth
 	};
 	registerGoogleMeetCreateCommands(context);