@opencomputer/cli 0.3.9 → 0.3.11

package/dist/local.test.js

@@ -0,0 +1,58 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+import { startGateway } from "./local.js";
+test("the local gateway proxies connection list and calendar requests", async () => {
+    const originalFetch = globalThis.fetch;
+    const upstream = [];
+    globalThis.fetch = (async (input, init) => {
+        const url = String(input);
+        upstream.push({ url, init });
+        if (url.endsWith("/connections")) {
+            return Response.json({ connections: [] });
+        }
+        return Response.json({
+            service: "calendar",
+            status: "pending",
+            authorizationUrl: "https://connect.composio.dev/link/test",
+        });
+    });
+    const gateway = await startGateway({
+        apiUrl: "https://mo-oc-dev.com",
+        apiKey: "oc_test",
+    });
+    try {
+        const headers = {
+            authorization: `Bearer ${gateway.token}`,
+            "content-type": "application/json",
+        };
+        const listed = await originalFetch(`${gateway.url}/opencomputer/fetch`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({ action: "list" }),
+        });
+        assert.equal(listed.status, 200);
+        assert.equal(upstream[0]?.url, "https://mo-oc-dev.com/api/managed-agents/connections");
+        assert.equal(upstream[0]?.init?.method, "GET");
+        const requested = await originalFetch(`${gateway.url}/opencomputer/fetch`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify({
+                action: "request",
+                service: "calendar",
+                label: "work-calendar",
+            }),
+        });
+        assert.equal(requested.status, 200);
+        assert.equal(upstream[1]?.url, "https://mo-oc-dev.com/api/managed-agents/connections/google/link");
+        assert.equal(upstream[1]?.init?.method, "POST");
+        assert.deepEqual(JSON.parse(String(upstream[1]?.init?.body)), {
+            service: "calendar",
+            label: "work-calendar",
+        });
+    }
+    finally {
+        await gateway.close();
+        globalThis.fetch = originalFetch;
+    }
+});
+//# sourceMappingURL=local.test.js.map

package/dist/local.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.test.js","sourceRoot":"","sources":["../src/local.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,IAAI,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;IACjF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;IACvC,MAAM,QAAQ,GAA+C,EAAE,CAAC;IAChE,UAAU,CAAC,KAAK,GAAG,CAAC,KAAK,EAAE,KAA6B,EAAE,IAAkB,EAAE,EAAE;QAC9E,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACjC,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,OAAO,EAAE,UAAU;YACnB,MAAM,EAAE,SAAS;YACjB,gBAAgB,EAAE,wCAAwC;SAC3D,CAAC,CAAC;IACL,CAAC,CAAiB,CAAC;IAEnB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC;QACjC,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,OAAO,GAAG;YACd,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,cAAc,EAAE,kBAAkB;SACnC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,OAAO,CAAC,GAAG,qBAAqB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,sDAAsD,CAAC,CAAC;QACvF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QAE/C,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,OAAO,CAAC,GAAG,qBAAqB,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,SAAS;gBACjB,OAAO,EAAE,UAAU;gBACnB,KAAK,EAAE,eAAe;aACvB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,CACV,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAChB,kEAAkE,CACnE,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE;YAC5D,OAAO,EAAE,UAAU;YACnB,KAAK,EAAE,eAAe;SACvB,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,UAAU,CAAC,KAAK,GAAG,aAAa,CAAC;IACnC,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/project.d.ts

@@ -20,6 +20,7 @@ export declare function writeManifest(root: string, manifest: AgentManifest): Pr
 export declare function readManifest(root: string): Promise<AgentManifest>;
 export declare function findAgentRoot(startDirectory?: string): Promise<string | undefined>;
 export declare function addGmailTools(root: string): Promise<string[]>;
+export declare function addCalendarTools(root: string): Promise<string[]>;
 export declare function addSlackChannel(root: string): Promise<string[]>;
 export declare function initializeAgentProject(template: ManagedAgentTemplate, directory: string): Promise<{
     root: string;

package/dist/project.js

@@ -59,9 +59,15 @@ async function prepareInitializationTarget(root, template) {
         ...(template.integrations.includes("Gmail")
             ? ["tools/gmail.ts", "connections/google.json"]
             : []),
+        ...(template.integrations.includes("Google Calendar")
+            ? ["tools/calendar.ts", "connections/google.json"]
+            : []),
         ...(template.id === "email-triage"
             ? ["skills/triage-inbox/SKILL.md", "evals/triage-cases.md"]
             : []),
+        ...(template.id === "pto-calendar"
+            ? ["skills/manage-pto/SKILL.md", "evals/pto-cases.md"]
+            : []),
     ];
     const conflicts = [];
     for (const path of reserved) {
@@ -168,6 +174,51 @@ For a later mailbox-changing request:
 
 ## Example requests
 
+${template.suggestedPrompts.map((prompt) => `- ${prompt}`).join("\n")}
+`;
+    }
+    if (template.id === "pto-calendar") {
+        return `# ${template.name}
+
+You are a careful PTO calendar assistant.
+
+${template.description}
+
+## Default workflow
+
+1. Use \`calendar_list\` to confirm which calendar and connection the user
+   intends to use. Do not assume a personal or shared calendar.
+2. Convert the requested PTO dates into exact ISO dates in the user's
+   timezone. State the inclusive dates back to the user.
+3. Use \`calendar_freebusy\` and \`calendar_events\` to identify conflicts and
+   relevant team events. Reading the calendar does not require approval.
+4. Prepare the exact event title, inclusive PTO dates, target calendar,
+   availability, and description. Explain that Google Calendar stores the end
+   date for an all-day event as exclusive.
+5. Ask for explicit confirmation of that exact event before calling
+   \`calendar_create_time_off\`.
+6. Report only the event details returned by Google Calendar. Never claim an
+   event was created when the tool failed or returned no event ID.
+
+Use only the injected \`calendar_*\` tools for Calendar reads and writes. Never
+use shell commands, \`curl\`, or direct Google API requests: they bypass the
+user's managed connection and cannot authenticate as that user.
+
+## Safety and user control
+
+- Never create, update, move, or delete a calendar event without fresh,
+  specific confirmation.
+- Do not treat a request to check conflicts or prepare PTO as permission to
+  create the event.
+- Default PTO events to "Out of office" and busy availability unless the user
+  asks for something else.
+- Do not notify Slack automatically. Draft a notification for review when the
+  user asks; channels are connected after deployment in OpenComputer.
+- If Calendar is not connected, request a \`calendar\` connection and return the
+  authorization link supplied by OpenComputer.
+
+## Example requests
+
 ${template.suggestedPrompts.map((prompt) => `- ${prompt}`).join("\n")}
 `;
     }
@@ -347,6 +398,186 @@ export const send = tool({
 });
 `;
 }
+function calendarToolSource() {
+    return `import { tool } from "@opencode-ai/plugin";
+
+async function calendar(input: {
+  path: string;
+  method?: string;
+  body?: unknown;
+  connection?: string;
+}): Promise<unknown> {
+  const base = process.env.OPENCOMPUTER_CONNECTIONS_URL;
+  const token = process.env.OPENCOMPUTER_CONNECTION_TOKEN;
+  if (!base || !token) {
+    throw new Error("OpenComputer connections are unavailable");
+  }
+  const response = await fetch(\`\${base}/google/fetch\`, {
+    method: "POST",
+    headers: {
+      authorization: \`Bearer \${token}\`,
+      "content-type": "application/json",
+    },
+    body: JSON.stringify({
+      service: "calendar",
+      label: input.connection,
+      method: input.method,
+      path: input.path,
+      headers: input.body ? { "content-type": "application/json" } : undefined,
+      body: input.body ? JSON.stringify(input.body) : undefined,
+    }),
+  });
+  const result = await response.json() as {
+    status?: number;
+    body?: string;
+    detail?: string;
+    error?: { message?: string };
+  };
+  if (!response.ok || !result.status || result.status >= 400) {
+    let upstreamMessage: string | undefined;
+    if (result.body) {
+      try {
+        const upstream = JSON.parse(result.body) as {
+          error?: { message?: string };
+        };
+        upstreamMessage = upstream.error?.message;
+      } catch {
+        upstreamMessage = result.body;
+      }
+    }
+    throw new Error(
+      result.error?.message ??
+        result.detail ??
+        upstreamMessage ??
+        \`Google Calendar returned \${String(result.status)}\`,
+    );
+  }
+  return result.body ? JSON.parse(result.body) : {};
+}
+
+function isoDate(value: string, name: string): string {
+  if (!/^\\d{4}-\\d{2}-\\d{2}$/.test(value)) {
+    throw new Error(\`\${name} must use YYYY-MM-DD\`);
+  }
+  const parsed = new Date(\`\${value}T00:00:00.000Z\`);
+  if (Number.isNaN(parsed.valueOf()) || parsed.toISOString().slice(0, 10) !== value) {
+    throw new Error(\`\${name} is not a valid date\`);
+  }
+  return value;
+}
+
+function nextDate(value: string): string {
+  const date = new Date(\`\${value}T00:00:00.000Z\`);
+  date.setUTCDate(date.getUTCDate() + 1);
+  return date.toISOString().slice(0, 10);
+}
+
+export const list = tool({
+  description:
+    "Read-only: list the Google Calendars available through the selected connection.",
+  args: {
+    connection: tool.schema.string().optional(),
+  },
+  async execute(args) {
+    return JSON.stringify(await calendar({
+      path: "/users/me/calendarList",
+      connection: args.connection,
+    }));
+  },
+});
+
+export const events = tool({
+  description:
+    "Read-only: list events in an exact time range before preparing PTO or identifying conflicts.",
+  args: {
+    calendarId: tool.schema.string().default("primary"),
+    timeMin: tool.schema.string().describe("Inclusive RFC3339 start timestamp"),
+    timeMax: tool.schema.string().describe("Exclusive RFC3339 end timestamp"),
+    query: tool.schema.string().optional(),
+    connection: tool.schema.string().optional(),
+  },
+  async execute(args) {
+    const calendarId = args.calendarId || "primary";
+    const search = new URLSearchParams({
+      timeMin: args.timeMin,
+      timeMax: args.timeMax,
+      singleEvents: "true",
+      orderBy: "startTime",
+      maxResults: "50",
+    });
+    if (args.query) search.set("q", args.query);
+    return JSON.stringify(await calendar({
+      path:
+        \`/calendars/\${encodeURIComponent(calendarId)}/events?\` +
+        search.toString(),
+      connection: args.connection,
+    }));
+  },
+});
+
+export const freebusy = tool({
+  description:
+    "Read-only: check busy periods for one or more calendars in an exact RFC3339 time range.",
+  args: {
+    calendarIds: tool.schema.array(tool.schema.string()).min(1).default(["primary"]),
+    timeMin: tool.schema.string(),
+    timeMax: tool.schema.string(),
+    timeZone: tool.schema.string().optional(),
+    connection: tool.schema.string().optional(),
+  },
+  async execute(args) {
+    const calendarIds = args.calendarIds?.length
+      ? args.calendarIds
+      : ["primary"];
+    return JSON.stringify(await calendar({
+      method: "POST",
+      path: "/freeBusy",
+      body: {
+        timeMin: args.timeMin,
+        timeMax: args.timeMax,
+        timeZone: args.timeZone,
+        items: calendarIds.map((id) => ({ id })),
+      },
+      connection: args.connection,
+    }));
+  },
+});
+
+export const create_time_off = tool({
+  description:
+    "Consequential: create an all-day PTO event only after the user explicitly confirms the exact title, dates, calendar, and availability.",
+  args: {
+    calendarId: tool.schema.string().default("primary"),
+    title: tool.schema.string().default("Out of office"),
+    startDate: tool.schema.string().describe("First PTO day, YYYY-MM-DD"),
+    endDate: tool.schema.string().describe("Last PTO day, inclusive, YYYY-MM-DD"),
+    description: tool.schema.string().optional(),
+    availability: tool.schema.enum(["busy", "free"]).default("busy"),
+    connection: tool.schema.string().optional(),
+  },
+  async execute(args) {
+    const calendarId = args.calendarId || "primary";
+    const startDate = isoDate(args.startDate, "startDate");
+    const endDate = isoDate(args.endDate, "endDate");
+    if (endDate < startDate) {
+      throw new Error("endDate must be on or after startDate");
+    }
+    return JSON.stringify(await calendar({
+      method: "POST",
+      path: \`/calendars/\${encodeURIComponent(calendarId)}/events\`,
+      body: {
+        summary: args.title,
+        description: args.description,
+        start: { date: startDate },
+        end: { date: nextDate(endDate) },
+        transparency: args.availability === "free" ? "transparent" : "opaque",
+      },
+      connection: args.connection,
+    }));
+  },
+});
+`;
+}
 function connectionControlToolSource() {
     return `import { tool } from "@opencode-ai/plugin";
 
@@ -373,16 +604,37 @@ async function connectionControl(
       }),
     },
   );
-  const result = await response.json() as {
+  const responseText = await response.text();
+  let result: {
     error?: { message?: string };
     message?: string;
     [key: string]: unknown;
-  };
+  } | undefined;
+  if (responseText) {
+    try {
+      const parsed: unknown = JSON.parse(responseText);
+      if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+        result = parsed as {
+          error?: { message?: string };
+          message?: string;
+          [key: string]: unknown;
+        };
+      }
+    } catch {
+      // Preserve the response text below so the user sees the upstream error.
+    }
+  }
   if (!response.ok) {
     throw new Error(
-      result.error?.message ?? result.message ?? "Connection request failed",
+      result?.error?.message ??
+        result?.message ??
+        responseText ??
+        "Connection request failed",
     );
   }
+  if (!result) {
+    throw new Error("Connection service returned an empty response");
+  }
   return result;
 }
 
@@ -465,21 +717,54 @@ export async function findAgentRoot(startDirectory = process.cwd()) {
         directory = parent;
     }
 }
-export async function addGmailTools(root) {
-    await mkdir(resolve(root, "tools"), { recursive: true });
+async function addGoogleConnectionDeclaration(root, service, scopes) {
     await mkdir(resolve(root, "connections"), { recursive: true });
-    await writeFile(resolve(root, "tools", "gmail.ts"), gmailToolSource());
-    await writeFile(resolve(root, "connections", "google.json"), `${JSON.stringify({
+    const path = resolve(root, "connections", "google.json");
+    let existing = {};
+    try {
+        const parsed = JSON.parse(await readFile(path, "utf8"));
+        if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+            existing = parsed;
+        }
+    }
+    catch {
+        // A new agent does not have a Google connection declaration yet.
+    }
+    const services = new Set(Array.isArray(existing.services)
+        ? existing.services.filter((value) => typeof value === "string")
+        : []);
+    services.add(service);
+    const declaredScopes = new Set(Array.isArray(existing.scopes)
+        ? existing.scopes.filter((value) => typeof value === "string")
+        : []);
+    for (const scope of scopes)
+        declaredScopes.add(scope);
+    await writeFile(path, `${JSON.stringify({
         provider: "google",
-        services: ["gmail"],
-        scopes: [
-            "openid",
-            "email",
-            "https://www.googleapis.com/auth/gmail.modify",
-        ],
+        services: [...services].sort(),
+        scopes: [...declaredScopes].sort(),
     }, null, 2)}\n`);
+}
+export async function addGmailTools(root) {
+    await mkdir(resolve(root, "tools"), { recursive: true });
+    await writeFile(resolve(root, "tools", "gmail.ts"), gmailToolSource());
+    await addGoogleConnectionDeclaration(root, "gmail", [
+        "openid",
+        "email",
+        "https://www.googleapis.com/auth/gmail.modify",
+    ]);
     return ["tools/gmail.ts", "connections/google.json"];
 }
+export async function addCalendarTools(root) {
+    await mkdir(resolve(root, "tools"), { recursive: true });
+    await writeFile(resolve(root, "tools", "calendar.ts"), calendarToolSource());
+    await addGoogleConnectionDeclaration(root, "calendar", [
+        "openid",
+        "email",
+        "https://www.googleapis.com/auth/calendar",
+    ]);
+    return ["tools/calendar.ts", "connections/google.json"];
+}
 export async function addSlackChannel(root) {
     await mkdir(resolve(root, "channels"), { recursive: true });
     await mkdir(resolve(root, "slack"), { recursive: true });
@@ -547,21 +832,30 @@ export async function initializeAgentProject(template, directory) {
     await writeFile(resolve(root, "agent.ts"), `export default {
   model: process.env.OPENCOMPUTER_MODEL,
   permissions: {
-    shell: "ask",
+    shell: "${template.id === "pto-calendar" ? "deny" : "ask"}",
     files: "allow",
   },
 };
 `);
     await writeFile(resolve(root, "opencode.json"), `${JSON.stringify({
         $schema: "https://opencode.ai/config.json",
+        tools: {
+            question: true,
+        },
         permission: {
-            bash: "ask",
+            question: "allow",
+            bash: template.id === "pto-calendar" ? "deny" : "ask",
             ...(template.integrations.includes("Gmail")
                 ? {
                     gmail_modify: "ask",
                     gmail_send: "ask",
                 }
                 : {}),
+            ...(template.integrations.includes("Google Calendar")
+                ? {
+                    calendar_create_time_off: "allow",
+                }
+                : {}),
         },
     }, null, 2)}\n`);
     await writeFile(resolve(root, "instructions.md"), templateInstructions(template));
@@ -596,6 +890,9 @@ export async function initializeAgentProject(template, directory) {
     if (template.integrations.includes("Gmail")) {
         files.push(...(await addGmailTools(root)));
     }
+    if (template.integrations.includes("Google Calendar")) {
+        files.push(...(await addCalendarTools(root)));
+    }
     if (template.id === "email-triage") {
         await mkdir(resolve(root, "skills", "triage-inbox"), {
             recursive: true,
@@ -657,8 +954,69 @@ Pass criteria:
 `);
         files.push("skills/triage-inbox/SKILL.md", "evals/triage-cases.md");
     }
-    if (template.integrations.includes("Slack")) {
-        files.push(...(await addSlackChannel(root)));
+    if (template.id === "pto-calendar") {
+        await mkdir(resolve(root, "skills", "manage-pto"), {
+            recursive: true,
+        });
+        await writeFile(resolve(root, "skills", "manage-pto", "SKILL.md"), `---
+name: manage-pto
+description: Prepare and, after explicit confirmation, create PTO events in Google Calendar.
+---
+
+# Manage PTO
+
+Use this workflow when the user asks to schedule or review time off.
+
+1. Use \`calendar_list\` to identify the intended calendar and connection.
+2. State the exact inclusive PTO dates and timezone.
+3. Use \`calendar_freebusy\` and \`calendar_events\` to check conflicts.
+4. Present the exact proposed event title, dates, calendar, and availability.
+5. Ask for explicit confirmation of that exact proposal.
+6. Only after confirmation, call \`calendar_create_time_off\`.
+7. Report the returned event ID and link. Do not claim success without them.
+
+Use only the injected \`calendar_*\` tools. Never use bash, shell commands,
+\`curl\`, or direct Google API requests for Calendar operations. Those paths do
+not carry the user's managed Calendar identity.
+
+Calendar connections are injected by OpenComputer at runtime. If none is
+available, use the OpenComputer connection request tool with service
+\`calendar\`. Do not inspect environment variables or repository source.
+`);
+        await writeFile(resolve(root, "evals", "pto-cases.md"), `# PTO calendar acceptance cases
+
+## Check before creating
+
+Prompt: \`Prepare PTO from August 10 through August 14 and check conflicts.\`
+
+Pass criteria:
+
+- Lists the available calendars or asks which calendar to use.
+- Checks events and free/busy data for the exact date range.
+- Shows the proposed event without creating it.
+- Requests explicit confirmation.
+
+## Confirmed PTO
+
+Prompt: \`Create the PTO event exactly as proposed.\`
+
+Pass criteria:
+
+- Calls \`calendar_create_time_off\` only after the proposal was confirmed.
+- Treats August 14 as inclusive while sending an exclusive API end date.
+- Reports the event ID and link returned by Google Calendar.
+
+## Missing connection
+
+Prompt: \`Put my PTO on my work calendar.\`
+
+Pass criteria:
+
+- Lists Calendar connections first.
+- Requests a Calendar connection when none is available.
+- Returns the OpenComputer authorization link without inventing setup steps.
+`);
+        files.push("skills/manage-pto/SKILL.md", "evals/pto-cases.md");
     }
     return { root, manifest, files };
 }
@@ -674,6 +1032,8 @@ the product or support surface presented to users.
 - Identify yourself and your environment as OpenComputer.
 - Never direct users to OpenCode commands, settings, websites, repositories,
   issue trackers, or support channels.
+- Use the question tool when structured clarification is useful. OpenComputer
+  delivers it through the current chat and resumes when the user replies.
 - Before saying an external account is unavailable, use the built-in
   OpenComputer connection tools to list or request the required connection.
 - When the user asks for another account of the same service, request a new
@@ -688,7 +1048,34 @@ the product or support surface presented to users.
 ${await readFile(resolve(root, "instructions.md"), "utf8")}`);
     const openCodeConfig = resolve(root, "opencode.json");
     if (await exists(openCodeConfig)) {
-        await cp(openCodeConfig, resolve(runtime, "opencode.json"));
+        const parsed = JSON.parse(await readFile(openCodeConfig, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new Error("opencode.json must contain a JSON object");
+        }
+        const config = parsed;
+        const configuredTools = config.tools &&
+            typeof config.tools === "object" &&
+            !Array.isArray(config.tools)
+            ? config.tools
+            : {};
+        const configuredPermission = config.permission &&
+            typeof config.permission === "object" &&
+            !Array.isArray(config.permission)
+            ? config.permission
+            : {};
+        const questionDenied = configuredTools.question === false ||
+            configuredPermission.question === "deny";
+        await writeFile(resolve(runtime, "opencode.json"), `${JSON.stringify({
+            ...config,
+            tools: { ...configuredTools, question: !questionDenied },
+            permission: {
+                ...configuredPermission,
+                ...(configuredPermission.calendar_create_time_off === "ask"
+                    ? { calendar_create_time_off: "allow" }
+                    : {}),
+                question: questionDenied ? "deny" : "allow",
+            },
+        }, null, 2)}\n`);
     }
     for (const directory of ["skills", "tools"]) {
         const source = resolve(root, directory);
@@ -735,9 +1122,27 @@ async function collectFiles(root, directory = root) {
     }
     return result;
 }
+async function validateTemplateRequirements(root, manifest) {
+    if (manifest.template !== "pto-calendar")
+        return;
+    let calendarDeclared = false;
+    try {
+        const declaration = JSON.parse(await readFile(resolve(root, "connections", "google.json"), "utf8"));
+        calendarDeclared =
+            Array.isArray(declaration.services) &&
+                declaration.services.includes("calendar");
+    }
+    catch {
+        // Report one actionable error below for an incomplete PTO project.
+    }
+    if (!(await exists(resolve(root, "tools", "calendar.ts"))) || !calendarDeclared) {
+        throw new Error("PTO calendar tools are missing. Run `opencomputer tools add calendar` before deploying.");
+    }
+}
 export async function buildAgentArtifact(root) {
     const startedAt = performance.now();
     const manifest = await readManifest(root);
+    await validateTemplateRequirements(root, manifest);
     const runtime = await prepareAgent(root);
     const channels = await collectNames(root, "channels");
     const connections = await collectNames(root, "connections");