@sentry/junior-google 0.241.0 → 0.243.0

package/README.md

@@ -4,7 +4,8 @@ Proof of concept. Junior acts as its own Google Workspace account, for example
 `junior@sentry.io`. Junior does not use the Google credentials of the people it
 helps. Tracking issue: getsentry/junior#2063.
 
-This version supports Calendar only. Drive and Gmail are out of scope.
+This version supports Calendar and reading Google Docs. Gmail and Drive
+writes are out of scope.
 
 ## Surfaces
 
@@ -41,6 +42,17 @@ This version supports Calendar only. Drive and Gmail are out of scope.
   annotation on the Conversation. Junior shows its card with the next reply.
   The card shows the title, time, and attendees, and links to the event. A
   change to an event replaces its card.
+- `searchGoogleDocs` finds Google Docs that are shared with Junior's account,
+  by words in the title or text. Docs that are only shared by public link are
+  not found, because Drive search only covers files the account has.
+- `readGoogleDoc` reads one Doc as Markdown, from a link or a document id. It
+  works for Docs shared with Junior's account and for Docs shared with anyone
+  who has the link. Drive exports the Doc, so the Docs API is not used. A
+  link's `resourcekey` value is sent to Google, because older Docs shared by
+  link need it. Results stop at 100,000 characters.
+- `listGoogleDocComments` reads the comments and replies on one Doc, 100 per
+  call. Each comment gives its author name, text, the Doc text it is attached
+  to, and whether it is resolved.
 - The **Google account** page on the dashboard Admin page shows whether the
   account is connected. Its Connect button starts Google sign-in.
 - `junior google connect` and `junior google status` are the operator CLI.
@@ -57,20 +69,21 @@ own.
 2. Google sign-in opens with PKCE and a single-use state value.
 3. The admin signs in as the configured account, not as themselves.
 4. Junior checks that the identity token names the configured account. It also
-   checks that Google granted every Calendar scope. If a check fails, Junior
-   revokes the grant and stores nothing.
+   checks that Google granted every Calendar and Docs scope. If a check
+   fails, Junior revokes the grant and stores nothing.
 5. Junior stores the refresh token in the `junior_google_accounts` table.
 
 At runtime, the `issueCredential` hook exchanges the refresh token for a
 one-hour access token. Junior applies that token only to `www.googleapis.com`
 requests from this plugin's tools. The `grantForEgress` hook denies sandbox
 commands and any request that does not match a declared operation. Thus the
-model cannot use `curl` to read Junior's calendar and skip the tool rules.
+model cannot use `curl` to read Junior's calendar or Drive and skip the tool
+rules.
 
 If Google rejects the refresh token (`invalid_grant`), Junior deletes it. The
 tools then report that an admin must connect the account again. If the stored
-grant does not have every scope the current tools need, the tools also ask an
-admin to reconnect.
+grant does not have every scope the current tools need, Google rejects the
+request and the tool asks an admin to reconnect.
 
 ## Rules in code
 
@@ -81,8 +94,11 @@ admin to reconnect.
   requester who is invited to the event. The `calendar.events.owned` scope
   also keeps events that other people organize out of reach.
 - Calendar scopes are `calendar.events.freebusy`, `calendar.events.readonly`,
-  and `calendar.events.owned`. Junior also requests `openid email` to verify
-  the account during sign-in.
+  and `calendar.events.owned`.
+- The Docs scope is `drive.readonly`. The Drive comments API accepts no
+  narrower read scope. Junior permits only these Drive requests: file search,
+  file metadata, export, and comment reads.
+- Junior also requests `openid email` to verify the account during sign-in.
 
 ## Setup
 
@@ -91,9 +107,10 @@ sign-in requests only its own scopes, so dashboard sign-in still asks only for
 identity.
 
 1. In the Google Cloud project of the dashboard OAuth client, enable the
-   Google Calendar API.
+   Google Calendar API and the Google Drive API.
 2. On the OAuth consent screen, use user type **Internal** and add the
-   Calendar scopes above.
+   Calendar and Docs scopes above. `drive.readonly` is a restricted scope.
+   An Internal app does not need Google verification for it.
 3. On the OAuth client, add these redirect URIs:
    - `https://<junior host>/api/plugins/google/oauth/callback`
    - `http://127.0.0.1:8765/oauth/callback`, for the CLI. Use another port with
@@ -126,6 +143,11 @@ variables are set. The Admin page shows **Not configured** until then.
 - Anyone who can talk to Junior can ask it to read a colleague's calendar.
   Junior returns what its own account can see, so set the sharing default
   with that in mind.
+- Anyone who can talk to Junior can also ask it to read any Doc shared with
+  Junior's account. Share a Doc with that account only when everyone who can
+  talk to Junior may read it.
+- `drive.readonly` lets the account read every Drive file it can open, not
+  only Docs. The tools read Google Docs only.
 - Google does not expose the working hours that people set in Calendar.
   Junior uses each calendar's time zone and one shared workday instead.
 - Junior cannot find or book meeting rooms. Room discovery needs the Admin

package/dist/config.d.ts

@@ -9,7 +9,8 @@ export declare const GOOGLE_CLIENT_SECRET_ENV = "GOOGLE_CLIENT_SECRET";
 export declare const GOOGLE_ACCOUNT_EMAIL_ENV = "GOOGLE_WORKSPACE_ACCOUNT_EMAIL";
 export declare const GOOGLE_ALLOWED_DOMAINS_ENV = "GOOGLE_WORKSPACE_ALLOWED_DOMAINS";
 /**
- * Scopes the Calendar tools need. Request nothing broader.
+ * API scopes the tools need. A connected grant must have all of them. Request
+ * nothing broader.
  *
  * - `calendar.events.freebusy`: availability for `findMeetingTimes`.
  * - `calendar.events.readonly`: events that Junior's account can see on other
@@ -17,8 +18,10 @@ export declare const GOOGLE_ALLOWED_DOMAINS_ENV = "GOOGLE_WORKSPACE_ALLOWED_DOMA
  *   still decide how much detail each calendar shows.
  * - `calendar.events.owned`: create and change events on Junior's own
  *   calendar.
+ * - `drive.readonly`: search, export, and read comments on Docs. The Drive
+ *   comments API accepts no narrower read scope.
  */
-export declare const GOOGLE_CALENDAR_SCOPES: readonly ["https://www.googleapis.com/auth/calendar.events.freebusy", "https://www.googleapis.com/auth/calendar.events.owned", "https://www.googleapis.com/auth/calendar.events.readonly"];
+export declare const GOOGLE_API_SCOPES: readonly ["https://www.googleapis.com/auth/calendar.events.freebusy", "https://www.googleapis.com/auth/calendar.events.owned", "https://www.googleapis.com/auth/calendar.events.readonly", "https://www.googleapis.com/auth/drive.readonly"];
 /** Identity scopes used only to verify which account signed in. */
 export declare const GOOGLE_IDENTITY_SCOPES: readonly ["openid", "email"];
 export interface GoogleConfig {

package/dist/credentials.d.ts

@@ -39,6 +39,26 @@ export declare const GOOGLE_OPERATIONS: {
         readonly method: "POST";
         readonly path: RegExp;
     };
+    readonly "google.drive.comments.list": {
+        readonly access: "read";
+        readonly method: "GET";
+        readonly path: RegExp;
+    };
+    readonly "google.drive.file.export": {
+        readonly access: "read";
+        readonly method: "GET";
+        readonly path: RegExp;
+    };
+    readonly "google.drive.file.get": {
+        readonly access: "read";
+        readonly method: "GET";
+        readonly path: RegExp;
+    };
+    readonly "google.drive.files.list": {
+        readonly access: "read";
+        readonly method: "GET";
+        readonly path: RegExp;
+    };
 };
 export type GoogleOperation = keyof typeof GOOGLE_OPERATIONS;
 /** Select the grant for one Google request, or deny it. */

package/dist/index.d.ts

@@ -3,7 +3,8 @@
  *
  * Junior acts as its own Google Workspace account. A Junior admin connects
  * that account out of band, through the dashboard Admin page or the CLI. Calendar
- * tools use host-owned egress, and the sandbox gets no Google credential.
+ * and Docs tools use host-owned egress, and the sandbox gets no Google
+ * credential.
  */
 import { type PluginRegistration } from "@sentry/junior-plugin-api";
 /** Register Junior's Google Workspace plugin. */

package/dist/index.js

@@ -13,10 +13,11 @@ var GOOGLE_CLIENT_ID_ENV = "GOOGLE_CLIENT_ID";
 var GOOGLE_CLIENT_SECRET_ENV = "GOOGLE_CLIENT_SECRET";
 var GOOGLE_ACCOUNT_EMAIL_ENV = "GOOGLE_WORKSPACE_ACCOUNT_EMAIL";
 var GOOGLE_ALLOWED_DOMAINS_ENV = "GOOGLE_WORKSPACE_ALLOWED_DOMAINS";
-var GOOGLE_CALENDAR_SCOPES = [
+var GOOGLE_API_SCOPES = [
   "https://www.googleapis.com/auth/calendar.events.freebusy",
   "https://www.googleapis.com/auth/calendar.events.owned",
-  "https://www.googleapis.com/auth/calendar.events.readonly"
+  "https://www.googleapis.com/auth/calendar.events.readonly",
+  "https://www.googleapis.com/auth/drive.readonly"
 ];
 var GOOGLE_IDENTITY_SCOPES = ["openid", "email"];
 function readEnv(name) {
@@ -147,7 +148,7 @@ function googleAuthorizationUrl(input) {
     prompt: "consent select_account",
     redirect_uri: input.redirectUri,
     response_type: "code",
-    scope: [...GOOGLE_IDENTITY_SCOPES, ...GOOGLE_CALENDAR_SCOPES].join(" "),
+    scope: [...GOOGLE_IDENTITY_SCOPES, ...GOOGLE_API_SCOPES].join(" "),
     state: input.request.state
   }).toString();
   return url.toString();
@@ -193,10 +194,10 @@ function verifyGrant(tokens, config) {
     };
   }
   const granted = new Set(grantedScopes(tokens));
-  const missing = GOOGLE_CALENDAR_SCOPES.filter((scope) => !granted.has(scope));
+  const missing = GOOGLE_API_SCOPES.filter((scope) => !granted.has(scope));
   if (missing.length > 0) {
     return {
-      reason: `Google did not grant every Calendar permission. Start again and allow all requested access. Missing: ${missing.join(", ")}`
+      reason: `Google did not grant every requested permission. Start again and allow all requested access. Missing: ${missing.join(", ")}`
     };
   }
   if (!tokens.refresh_token) {
@@ -465,6 +466,26 @@ var GOOGLE_OPERATIONS = {
     access: "read",
     method: "POST",
     path: /^\/calendar\/v3\/freeBusy$/
+  },
+  "google.drive.comments.list": {
+    access: "read",
+    method: "GET",
+    path: /^\/drive\/v3\/files\/[A-Za-z0-9_-]+\/comments$/
+  },
+  "google.drive.file.export": {
+    access: "read",
+    method: "GET",
+    path: /^\/drive\/v3\/files\/[A-Za-z0-9_-]+\/export$/
+  },
+  "google.drive.file.get": {
+    access: "read",
+    method: "GET",
+    path: /^\/drive\/v3\/files\/[A-Za-z0-9_-]+$/
+  },
+  "google.drive.files.list": {
+    access: "read",
+    method: "GET",
+    path: /^\/drive\/v3\/files$/
   }
 };
 function googleGrantForEgress(ctx) {
@@ -776,7 +797,10 @@ async function withRequester(ctx, emails) {
   return [...new Set(all)];
 }
 var googleErrorSchema = z2.object({
-  error: z2.object({ message: z2.string().optional() }).optional()
+  error: z2.object({
+    details: z2.array(z2.object({ reason: z2.string().optional() })).optional(),
+    message: z2.string().optional()
+  }).optional()
 });
 async function googleApiRequest(ctx, input) {
   const url = new URL(`https://${GOOGLE_API_DOMAIN}${input.path}`);
@@ -790,17 +814,26 @@ async function googleApiRequest(ctx, input) {
       method: GOOGLE_OPERATIONS[input.operation].method,
       headers: {
         Accept: "application/json",
-        "Content-Type": "application/json"
+        "Content-Type": "application/json",
+        ...input.headers
       },
       body: input.body === void 0 ? void 0 : JSON.stringify(input.body)
     })
   });
-  const body = await response.json().catch(() => void 0);
+  const body = response.headers.get("content-type")?.includes("json") ? await response.json().catch(() => void 0) : await response.text() || void 0;
   return { body, status: response.status };
 }
 function googleApiError(operation, response) {
   const parsed = googleErrorSchema.safeParse(response.body);
-  const detail = parsed.success ? parsed.data.error?.message : void 0;
+  const error = parsed.success ? parsed.data.error : void 0;
+  if (response.status === 403 && error?.details?.some(
+    (detail2) => detail2.reason === "ACCESS_TOKEN_SCOPE_INSUFFICIENT"
+  )) {
+    return new Error(
+      `Junior's Google account does not have the permission that ${operation} needs. A Junior admin must reconnect it on the dashboard Admin page or with \`junior google connect\`.`
+    );
+  }
+  const detail = error?.message;
   const message = `Google ${operation} failed with HTTP ${response.status}${detail ? `: ${detail}` : ""}`;
   return response.status === 400 ? new PluginToolInputError(message) : new Error(message);
 }
@@ -1497,72 +1530,246 @@ function createFindMeetingTimesTool(ctx) {
   });
 }
 
-// src/tools/list-events.ts
+// src/tools/list-doc-comments.ts
 import {
   definePluginTool as definePluginTool4,
-  PluginToolInputError as PluginToolInputError4,
   pluginToolOutputSchema as pluginToolOutputSchema4
 } from "@sentry/junior-plugin-api";
+import { z as z7 } from "zod";
+
+// src/tools/docs.ts
+import { PluginToolInputError as PluginToolInputError4 } from "@sentry/junior-plugin-api";
 import { z as z6 } from "zod";
+var GOOGLE_DOC_MIME_TYPE = "application/vnd.google-apps.document";
+var docReferenceSchema = z6.string().trim().min(10).max(2048).describe(
+  "Google Docs link, or a document id from searchGoogleDocs. Keep the full link for Docs shared by link: it can carry a resource key that Google needs."
+);
+var FILE_ID_PATTERN = /^[A-Za-z0-9_-]{10,200}$/;
+function parseDocReference(value) {
+  let fileId = value;
+  let resourceKey;
+  if (/^https?:\/\//.test(value)) {
+    const url = URL.parse(value);
+    fileId = url?.pathname.match(/\/d\/([^/]+)/)?.[1] ?? url?.searchParams.get("id") ?? "";
+    resourceKey = url?.searchParams.get("resourcekey") ?? void 0;
+  }
+  if (!FILE_ID_PATTERN.test(fileId)) {
+    throw new PluginToolInputError4(
+      "Use a Google Docs link or a document id from searchGoogleDocs."
+    );
+  }
+  return { fileId, ...resourceKey ? { resourceKey } : void 0 };
+}
+async function driveFileRequest(ctx, doc, input) {
+  const response = await googleApiRequest(ctx, {
+    ...input,
+    headers: {
+      ...input.headers,
+      ...doc.resourceKey ? {
+        "X-Goog-Drive-Resource-Keys": `${doc.fileId}/${doc.resourceKey}`
+      } : void 0
+    }
+  });
+  if (response.status === 404) {
+    throw new PluginToolInputError4(
+      `Junior's Google account (${ctx.accountEmail}) cannot open this Doc. Ask the owner to share it with that account, or to share it with anyone who has the link.`
+    );
+  }
+  if (response.status !== 200) {
+    throw googleApiError(input.operation, response);
+  }
+  return response;
+}
+var docFileSchema = z6.object({
+  id: z6.string(),
+  mimeType: z6.string(),
+  modifiedTime: z6.string().optional(),
+  name: z6.string(),
+  webViewLink: z6.string().optional()
+});
+async function readDocFile(ctx, doc) {
+  const response = await driveFileRequest(ctx, doc, {
+    operation: "google.drive.file.get",
+    path: `/drive/v3/files/${doc.fileId}`,
+    query: {
+      fields: "id,mimeType,modifiedTime,name,webViewLink",
+      supportsAllDrives: "true"
+    }
+  });
+  const file = docFileSchema.parse(response.body);
+  if (file.mimeType !== GOOGLE_DOC_MIME_TYPE) {
+    throw new PluginToolInputError4(
+      `"${file.name}" is not a Google Doc (${file.mimeType}). Junior can only read Google Docs.`
+    );
+  }
+  return file;
+}
+
+// src/tools/list-doc-comments.ts
+var inputSchema4 = z7.object({
+  document: docReferenceSchema,
+  pageToken: z7.string().min(1).max(2048).optional().describe("nextPageToken from an earlier call, to read more comments.")
+}).strict();
+var replyOutputSchema = z7.object({
+  action: z7.enum(["resolve", "reopen"]).optional().describe("Set when the reply resolved or reopened the comment."),
+  author: z7.string().optional(),
+  content: z7.string(),
+  createdTime: z7.string().optional()
+});
+var commentOutputSchema = z7.object({
+  author: z7.string().optional(),
+  commentId: z7.string(),
+  content: z7.string(),
+  createdTime: z7.string().optional(),
+  quotedText: z7.string().optional().describe("The Doc text that the comment is attached to."),
+  replies: z7.array(replyOutputSchema),
+  resolved: z7.boolean()
+});
+var outputSchema4 = pluginToolOutputSchema4.extend({
+  target: z7.literal("listGoogleDocComments"),
+  comments: z7.array(commentOutputSchema),
+  documentId: z7.string(),
+  nextPageToken: z7.string().optional().describe("Set when the Doc has more comments. Pass it as pageToken.")
+});
+var authorSchema = z7.object({ displayName: z7.string().optional() }).optional();
+var commentListSchema = z7.object({
+  comments: z7.array(
+    z7.object({
+      author: authorSchema,
+      content: z7.string().default(""),
+      createdTime: z7.string().optional(),
+      id: z7.string(),
+      quotedFileContent: z7.object({ value: z7.string().optional() }).optional(),
+      replies: z7.array(
+        z7.object({
+          // Google may add actions; keep only the known ones.
+          action: z7.enum(["resolve", "reopen"]).optional().catch(void 0),
+          author: authorSchema,
+          content: z7.string().default(""),
+          createdTime: z7.string().optional()
+        })
+      ).default([]),
+      resolved: z7.boolean().optional()
+    })
+  ).default([]),
+  nextPageToken: z7.string().optional()
+});
+var COMMENT_FIELDS = "comments(author/displayName,content,createdTime,id,quotedFileContent/value,resolved,replies(action,author/displayName,content,createdTime)),nextPageToken";
+function createListGoogleDocCommentsTool(ctx) {
+  return definePluginTool4({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: true
+    },
+    description: "List the comments and replies on one Google Doc, as Junior's own Google account sees them. Each comment gives its author, text, the Doc text it is attached to, and whether it is resolved. Works for Docs shared with that account and Docs shared with anyone who has the link. Returns up to 100 comments per call; pass nextPageToken as pageToken to read more. Comments can be private: share only what the requester needs.",
+    inputSchema: inputSchema4,
+    outputSchema: outputSchema4,
+    async execute(input) {
+      const doc = parseDocReference(input.document);
+      await readDocFile(ctx, doc);
+      const response = await driveFileRequest(ctx, doc, {
+        operation: "google.drive.comments.list",
+        path: `/drive/v3/files/${doc.fileId}/comments`,
+        query: {
+          fields: COMMENT_FIELDS,
+          pageSize: "100",
+          ...input.pageToken ? { pageToken: input.pageToken } : void 0
+        }
+      });
+      const { comments, nextPageToken } = commentListSchema.parse(
+        response.body
+      );
+      return {
+        target: "listGoogleDocComments",
+        comments: comments.map((comment) => ({
+          ...comment.author?.displayName ? { author: comment.author.displayName } : void 0,
+          commentId: comment.id,
+          content: comment.content,
+          ...comment.createdTime ? { createdTime: comment.createdTime } : void 0,
+          ...comment.quotedFileContent?.value ? { quotedText: comment.quotedFileContent.value } : void 0,
+          replies: comment.replies.map((reply) => ({
+            ...reply.action ? { action: reply.action } : void 0,
+            ...reply.author?.displayName ? { author: reply.author.displayName } : void 0,
+            content: reply.content,
+            ...reply.createdTime ? { createdTime: reply.createdTime } : void 0
+          })),
+          resolved: comment.resolved === true
+        })),
+        documentId: doc.fileId,
+        ...nextPageToken ? { nextPageToken } : void 0
+      };
+    }
+  });
+}
+
+// src/tools/list-events.ts
+import {
+  definePluginTool as definePluginTool5,
+  PluginToolInputError as PluginToolInputError5,
+  pluginToolOutputSchema as pluginToolOutputSchema5
+} from "@sentry/junior-plugin-api";
+import { z as z8 } from "zod";
 var MAX_WINDOW_MS2 = 31 * 24 * 60 * 60 * 1e3;
-var inputSchema4 = z6.object({
-  calendar: z6.string().trim().toLowerCase().pipe(z6.email()).optional().describe(
+var inputSchema5 = z8.object({
+  calendar: z8.string().trim().toLowerCase().pipe(z8.email()).optional().describe(
     "Email address of the person whose calendar to read. Omit to read Junior's own calendar, which holds every event Junior organizes."
   ),
-  timeMin: z6.iso.datetime({ offset: true }).describe("Start of the window, RFC 3339 with offset."),
-  timeMax: z6.iso.datetime({ offset: true }).describe(
+  timeMin: z8.iso.datetime({ offset: true }).describe("Start of the window, RFC 3339 with offset."),
+  timeMax: z8.iso.datetime({ offset: true }).describe(
     "End of the window, RFC 3339 with offset. At most 31 days after timeMin."
   ),
   timeZone: timeZoneSchema,
-  maxResults: z6.number().int().min(1).max(100).default(50)
+  maxResults: z8.number().int().min(1).max(100).default(50)
 }).strict();
-var eventSchema = z6.object({
-  attendees: z6.array(attendeeOutputSchema).optional(),
-  end: z6.string(),
-  eventId: z6.string(),
-  label: z6.string(),
-  location: z6.string().optional(),
-  organizer: z6.string().optional(),
-  organizedByJunior: z6.boolean().describe(
+var eventSchema = z8.object({
+  attendees: z8.array(attendeeOutputSchema).optional(),
+  end: z8.string(),
+  eventId: z8.string(),
+  label: z8.string(),
+  location: z8.string().optional(),
+  organizer: z8.string().optional(),
+  organizedByJunior: z8.boolean().describe(
     "True when Junior organizes the event, so Junior can change or cancel it with this eventId."
   ),
-  seriesEventId: z6.string().optional().describe(
+  seriesEventId: z8.string().optional().describe(
     "Set when this is one occurrence of a repeating event. It is the id of the whole series."
   ),
-  start: z6.string(),
-  title: z6.string().optional(),
-  url: z6.string().optional(),
-  videoCallUrl: z6.string().optional()
+  start: z8.string(),
+  title: z8.string().optional(),
+  url: z8.string().optional(),
+  videoCallUrl: z8.string().optional()
 });
-var outputSchema4 = pluginToolOutputSchema4.extend({
-  target: z6.literal("listCalendarEvents"),
-  calendar: z6.string(),
-  events: z6.array(eventSchema),
-  timeZone: z6.string(),
-  truncated: z6.boolean(),
-  visible: z6.boolean()
+var outputSchema5 = pluginToolOutputSchema5.extend({
+  target: z8.literal("listCalendarEvents"),
+  calendar: z8.string(),
+  events: z8.array(eventSchema),
+  timeZone: z8.string(),
+  truncated: z8.boolean(),
+  visible: z8.boolean()
 });
-var eventTimeSchema = z6.object({
-  date: z6.string().optional(),
-  dateTime: z6.string().optional()
+var eventTimeSchema = z8.object({
+  date: z8.string().optional(),
+  dateTime: z8.string().optional()
 });
-var listResponseSchema = z6.object({
-  items: z6.array(
-    z6.object({
-      attendees: z6.array(googleAttendeeSchema).optional(),
+var listResponseSchema = z8.object({
+  items: z8.array(
+    z8.object({
+      attendees: z8.array(googleAttendeeSchema).optional(),
       end: eventTimeSchema,
-      hangoutLink: z6.string().optional(),
-      htmlLink: z6.string().optional(),
-      id: z6.string(),
-      location: z6.string().optional(),
-      organizer: z6.object({ email: z6.string().optional() }).optional(),
-      recurringEventId: z6.string().optional(),
+      hangoutLink: z8.string().optional(),
+      htmlLink: z8.string().optional(),
+      id: z8.string(),
+      location: z8.string().optional(),
+      organizer: z8.object({ email: z8.string().optional() }).optional(),
+      recurringEventId: z8.string().optional(),
       start: eventTimeSchema,
-      status: z6.string().optional(),
-      summary: z6.string().optional()
+      status: z8.string().optional(),
+      summary: z8.string().optional()
     })
   ).default([]),
-  nextPageToken: z6.string().optional()
+  nextPageToken: z8.string().optional()
 });
 function lastAllDayDate(end) {
   if (!end.date) return void 0;
@@ -1583,7 +1790,7 @@ function eventLabel(start, end, timeZone) {
   return last && last !== first ? `${first} to ${last}, all day` : `${first}, all day`;
 }
 function createListCalendarEventsTool(ctx) {
-  return definePluginTool4({
+  return definePluginTool5({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -1591,17 +1798,17 @@ function createListCalendarEventsTool(ctx) {
       readOnlyHint: true
     },
     description: "List events on a colleague's Google Calendar or on Junior's own calendar, as seen by Junior's own Google account. Shows titles, times, locations, organizer, and attendee responses when the calendar's sharing settings allow it. Use it to find an event to change or cancel, check who accepted, or see what someone has coming up. Events without a title are busy blocks the owner did not share. Only calendars in the company's Google Workspace domains can be read. Calendar details can be private: share only what the requester needs, and avoid repeating them in public channels.",
-    inputSchema: inputSchema4,
-    outputSchema: outputSchema4,
+    inputSchema: inputSchema5,
+    outputSchema: outputSchema5,
     async execute(input) {
       const timeZone = input.timeZone ?? await ctx.users.resolveTimezone();
       const timeMinMs = Date.parse(input.timeMin);
       const timeMaxMs = Date.parse(input.timeMax);
       if (timeMaxMs <= timeMinMs) {
-        throw new PluginToolInputError4("timeMax must be after timeMin.");
+        throw new PluginToolInputError5("timeMax must be after timeMin.");
       }
       if (timeMaxMs - timeMinMs > MAX_WINDOW_MS2) {
-        throw new PluginToolInputError4("Read at most 31 days at a time.");
+        throw new PluginToolInputError5("Read at most 31 days at a time.");
       }
       const calendar = input.calendar ?? ctx.accountEmail;
       requireAllowedEmails([calendar], ctx.allowedDomains);
@@ -1652,29 +1859,167 @@ function createListCalendarEventsTool(ctx) {
   });
 }
 
+// src/tools/read-doc.ts
+import {
+  definePluginTool as definePluginTool6,
+  pluginToolOutputSchema as pluginToolOutputSchema6
+} from "@sentry/junior-plugin-api";
+import { z as z9 } from "zod";
+var MAX_CONTENT_CHARS = 1e5;
+var inputSchema6 = z9.object({
+  document: docReferenceSchema
+}).strict();
+var outputSchema6 = pluginToolOutputSchema6.extend({
+  target: z9.literal("readGoogleDoc"),
+  content: z9.string().describe("Doc text as Markdown."),
+  documentId: z9.string(),
+  modifiedTime: z9.string().optional(),
+  title: z9.string(),
+  truncated: z9.boolean().describe(
+    `True when the Doc is longer than ${MAX_CONTENT_CHARS} characters and the end is left out.`
+  ),
+  url: z9.string().optional()
+});
+function createReadGoogleDocTool(ctx) {
+  return definePluginTool6({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: true
+    },
+    description: "Read the text of one Google Doc as Markdown, as Junior's own Google account sees it. Works for Docs shared with that account and Docs shared with anyone who has the link. Comments are not included; use listGoogleDocComments for them. Doc contents can be private: share only what the requester needs, and avoid repeating them in public channels.",
+    inputSchema: inputSchema6,
+    outputSchema: outputSchema6,
+    async execute(input) {
+      const doc = parseDocReference(input.document);
+      const file = await readDocFile(ctx, doc);
+      const response = await driveFileRequest(ctx, doc, {
+        headers: { Accept: "text/markdown" },
+        operation: "google.drive.file.export",
+        path: `/drive/v3/files/${doc.fileId}/export`,
+        query: { mimeType: "text/markdown" }
+      });
+      const content = typeof response.body === "string" ? response.body : "";
+      return {
+        target: "readGoogleDoc",
+        content: content.slice(0, MAX_CONTENT_CHARS),
+        documentId: file.id,
+        ...file.modifiedTime ? { modifiedTime: file.modifiedTime } : void 0,
+        title: file.name,
+        truncated: content.length > MAX_CONTENT_CHARS,
+        ...file.webViewLink ? { url: file.webViewLink } : void 0
+      };
+    }
+  });
+}
+
+// src/tools/search-docs.ts
+import {
+  definePluginTool as definePluginTool7,
+  pluginToolOutputSchema as pluginToolOutputSchema7
+} from "@sentry/junior-plugin-api";
+import { z as z10 } from "zod";
+var inputSchema7 = z10.object({
+  query: z10.string().trim().min(1).max(500).describe("Words to find in the Doc title or text."),
+  maxResults: z10.number().int().min(1).max(50).default(10)
+}).strict();
+var outputSchema7 = pluginToolOutputSchema7.extend({
+  target: z10.literal("searchGoogleDocs"),
+  documents: z10.array(
+    z10.object({
+      documentId: z10.string(),
+      modifiedTime: z10.string().optional(),
+      title: z10.string(),
+      url: z10.string().optional()
+    })
+  ),
+  truncated: z10.boolean().describe(
+    "True when more Docs match, or Google did not search every Drive."
+  )
+});
+var fileListSchema = z10.object({
+  files: z10.array(
+    z10.object({
+      id: z10.string(),
+      modifiedTime: z10.string().optional(),
+      name: z10.string(),
+      webViewLink: z10.string().optional()
+    })
+  ).default([]),
+  incompleteSearch: z10.boolean().optional(),
+  nextPageToken: z10.string().optional()
+});
+function driveQueryString(value) {
+  return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+}
+function createSearchGoogleDocsTool(ctx) {
+  return definePluginTool7({
+    annotations: {
+      destructiveHint: false,
+      idempotentHint: true,
+      openWorldHint: true,
+      readOnlyHint: true
+    },
+    description: "Find Google Docs shared with Junior's own Google account, by words in the title or text. Docs that are only shared by public link are not found; ask for their link and use readGoogleDoc instead. Returns document ids for readGoogleDoc and listGoogleDocComments.",
+    inputSchema: inputSchema7,
+    outputSchema: outputSchema7,
+    async execute(input) {
+      const response = await googleApiRequest(ctx, {
+        operation: "google.drive.files.list",
+        path: "/drive/v3/files",
+        query: {
+          corpora: "allDrives",
+          fields: "files(id,modifiedTime,name,webViewLink),incompleteSearch,nextPageToken",
+          includeItemsFromAllDrives: "true",
+          pageSize: String(input.maxResults),
+          q: `mimeType = '${GOOGLE_DOC_MIME_TYPE}' and trashed = false and fullText contains ${driveQueryString(input.query)}`,
+          supportsAllDrives: "true"
+        }
+      });
+      if (response.status !== 200) {
+        throw googleApiError("google.drive.files.list", response);
+      }
+      const { files, incompleteSearch, nextPageToken } = fileListSchema.parse(
+        response.body
+      );
+      return {
+        target: "searchGoogleDocs",
+        documents: files.map((file) => ({
+          documentId: file.id,
+          ...file.modifiedTime ? { modifiedTime: file.modifiedTime } : void 0,
+          title: file.name,
+          ...file.webViewLink ? { url: file.webViewLink } : void 0
+        })),
+        truncated: nextPageToken !== void 0 || incompleteSearch === true
+      };
+    }
+  });
+}
+
 // src/tools/update-event.ts
 import {
-  definePluginTool as definePluginTool5,
-  PluginToolInputError as PluginToolInputError5,
-  pluginToolOutputSchema as pluginToolOutputSchema5
+  definePluginTool as definePluginTool8,
+  PluginToolInputError as PluginToolInputError6,
+  pluginToolOutputSchema as pluginToolOutputSchema8
 } from "@sentry/junior-plugin-api";
-import { z as z7 } from "zod";
-var inputSchema5 = z7.object({
+import { z as z11 } from "zod";
+var inputSchema8 = z11.object({
   eventId: ownEventIdSchema,
-  title: z7.string().trim().min(1).max(200).optional(),
-  description: z7.string().max(4e3).optional().describe(
+  title: z11.string().trim().min(1).max(200).optional(),
+  description: z11.string().max(4e3).optional().describe(
     "Replacement description. Do not include private details the attendees should not see."
   ),
-  start: z7.iso.datetime({ offset: true }).optional().describe("New start, RFC 3339 with offset. Give end too."),
-  end: z7.iso.datetime({ offset: true }).optional().describe("New end, RFC 3339 with offset. Give start too."),
+  start: z11.iso.datetime({ offset: true }).optional().describe("New start, RFC 3339 with offset. Give end too."),
+  end: z11.iso.datetime({ offset: true }).optional().describe("New end, RFC 3339 with offset. Give start too."),
   timeZone: timeZoneSchema,
-  location: z7.string().trim().max(500).optional().describe(
+  location: z11.string().trim().max(500).optional().describe(
     "Replacement location, such as a room name or address. Use an empty string to clear it."
   ),
   addAttendees: emailListSchema(50).default([]).describe("Email addresses to invite as required attendees."),
   addOptionalAttendees: emailListSchema(50).default([]).describe("Email addresses to invite as optional attendees."),
   removeAttendees: emailListSchema(50).default([]).describe("Email addresses to remove from the event."),
-  addVideoCall: z7.literal(true).optional().describe("Add a Google Meet link when the event has none.")
+  addVideoCall: z11.literal(true).optional().describe("Add a Google Meet link when the event has none.")
 }).strict().refine(
   (input) => input.start === void 0 === (input.end === void 0),
   {
@@ -1684,12 +2029,12 @@ var inputSchema5 = z7.object({
   (input) => input.title !== void 0 || input.description !== void 0 || input.start !== void 0 || input.location !== void 0 || input.addVideoCall !== void 0 || input.addAttendees.length > 0 || input.addOptionalAttendees.length > 0 || input.removeAttendees.length > 0,
   { message: "Give at least one change." }
 );
-var outputSchema5 = pluginToolOutputSchema5.extend({
-  target: z7.literal("updateCalendarEvent"),
+var outputSchema8 = pluginToolOutputSchema8.extend({
+  target: z11.literal("updateCalendarEvent"),
   ...ownEventOutputFields
 });
 function createUpdateCalendarEventTool(ctx) {
-  return definePluginTool5({
+  return definePluginTool8({
     annotations: {
       destructiveHint: false,
       idempotentHint: true,
@@ -1710,17 +2055,17 @@ function createUpdateCalendarEventTool(ctx) {
       return `Update Google Calendar event ${input.eventId}: ${changes.join("; ")}. Attendees get an email about the change.`;
     },
     description: "Change a Google Calendar event organized by Junior's own Google account: title, description, time, location, video call, or attendees. Use it to reschedule, add or remove people, or fix details. Google emails the attendees about the change, and existing attendees keep their responses. Only people invited to the event can ask for changes, and only people in the company's Google Workspace domains can be invited. Junior cannot change events other people organize. For a repeating event, an occurrence id changes only that occurrence; its seriesEventId changes every occurrence. Confirm the change with the requester first unless they already stated it exactly.",
-    inputSchema: inputSchema5,
-    outputSchema: outputSchema5,
+    inputSchema: inputSchema8,
+    outputSchema: outputSchema8,
     async execute(input) {
       const timeZone = input.timeZone ?? await ctx.users.resolveTimezone();
       if (input.start && input.end) {
         const durationMs = Date.parse(input.end) - Date.parse(input.start);
         if (durationMs <= 0) {
-          throw new PluginToolInputError5("end must be after start.");
+          throw new PluginToolInputError6("end must be after start.");
         }
         if (durationMs > MAX_EVENT_MS) {
-          throw new PluginToolInputError5("Events can be at most 8 hours long.");
+          throw new PluginToolInputError6("Events can be at most 8 hours long.");
         }
       }
       requireAllowedEmails(
@@ -1729,7 +2074,7 @@ function createUpdateCalendarEventTool(ctx) {
       );
       const read = await readOwnEventForRequester(ctx, input.eventId, "change");
       if (read.status === "cancelled") {
-        throw new PluginToolInputError5(
+        throw new PluginToolInputError6(
           "This event is cancelled. Create a new event instead."
         );
       }
@@ -1802,7 +2147,7 @@ function googlePlugin() {
     manifest: {
       name: "google",
       displayName: "Google Workspace",
-      description: "Google Calendar scheduling as Junior's own Google Workspace account",
+      description: "Google Calendar scheduling and Google Docs reading as Junior's own Google Workspace account",
       domains: [GOOGLE_API_DOMAIN],
       envVars: {
         [GOOGLE_CLIENT_ID_ENV]: {},
@@ -1838,6 +2183,9 @@ function googlePlugin() {
           createCalendarEvent: createCreateCalendarEventTool(toolContext),
           findMeetingTimes: createFindMeetingTimesTool(toolContext),
           listCalendarEvents: createListCalendarEventsTool(toolContext),
+          listGoogleDocComments: createListGoogleDocCommentsTool(toolContext),
+          readGoogleDoc: createReadGoogleDocTool(toolContext),
+          searchGoogleDocs: createSearchGoogleDocsTool(toolContext),
           updateCalendarEvent: createUpdateCalendarEventTool(toolContext)
         };
       }

package/dist/tools/docs.d.ts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import type { GoogleOperation } from "../credentials";
+import { type GoogleToolContext } from "./shared";
+export declare const GOOGLE_DOC_MIME_TYPE = "application/vnd.google-apps.document";
+/** Doc id or link input for the tools that read one Doc. */
+export declare const docReferenceSchema: z.ZodString;
+/** One Drive file, and the resource key that a link-shared file can need. */
+export interface DocReference {
+    fileId: string;
+    resourceKey?: string;
+}
+/**
+ * Return the file id and resource key from a Doc id or link.
+ *
+ * Links look like `docs.google.com/document/d/<id>/edit`,
+ * `drive.google.com/file/d/<id>/view`, or `drive.google.com/open?id=<id>`.
+ * Older Docs shared by link also need the link's `resourcekey` value.
+ */
+export declare function parseDocReference(value: string): DocReference;
+/** Call one Drive operation on a file, with its resource key when known. */
+export declare function driveFileRequest(ctx: GoogleToolContext, doc: DocReference, input: {
+    headers?: Record<string, string>;
+    operation: GoogleOperation;
+    path: string;
+    query?: Record<string, string>;
+}): Promise<{
+    body: unknown;
+    status: number;
+}>;
+/** Read the Drive metadata of one file, and require it to be a Google Doc. */
+export declare function readDocFile(ctx: GoogleToolContext, doc: DocReference): Promise<{
+    id: string;
+    mimeType: string;
+    name: string;
+    modifiedTime?: string | undefined;
+    webViewLink?: string | undefined;
+}>;

package/dist/tools/list-doc-comments.d.ts

@@ -0,0 +1,152 @@
+import type { GoogleToolContext } from "./shared";
+/** List the comments and replies on one Google Doc. */
+export declare function createListGoogleDocCommentsTool(ctx: GoogleToolContext): import("@sentry/junior-plugin-api").PluginToolDefinition<{
+    document: string;
+    pageToken?: string | undefined;
+}, {
+    [x: string]: unknown;
+    target: "listGoogleDocComments";
+    comments: {
+        commentId: string;
+        content: string;
+        replies: {
+            content: string;
+            action?: "resolve" | "reopen" | undefined;
+            author?: string | undefined;
+            createdTime?: string | undefined;
+        }[];
+        resolved: boolean;
+        author?: string | undefined;
+        createdTime?: string | undefined;
+        quotedText?: string | undefined;
+    }[];
+    documentId: string;
+    objectAnnotations?: {
+        kind: "object";
+        key: string;
+        label: string;
+        objectType: "code_change" | "task" | "deployment" | "calendar_event" | "automation" | "item";
+        title: string;
+        url: string | null;
+        description?: string | undefined;
+        status?: string | undefined;
+        trigger?: string | undefined;
+        warning?: string | undefined;
+        displayType?: string | undefined;
+        sourceUpdatedAt?: string | undefined;
+        facts?: {
+            type: "code_change";
+            author?: string | undefined;
+            sourceBranch?: string | undefined;
+            targetBranch?: string | undefined;
+            reviewers?: string[] | undefined;
+            review?: "required" | "approved" | "changes_requested" | undefined;
+            checks?: {
+                passed: number;
+                failed: number;
+                pending: number;
+            } | undefined;
+            mergeable?: boolean | undefined;
+            changedFiles?: number | undefined;
+            additions?: number | undefined;
+            deletions?: number | undefined;
+        } | {
+            type: "task";
+            assignees?: string[] | undefined;
+            priority?: string | undefined;
+            project?: string | undefined;
+            cycle?: string | undefined;
+            dueDate?: string | undefined;
+            labels?: string[] | undefined;
+        } | {
+            type: "deployment";
+            project?: string | undefined;
+            environment?: string | undefined;
+            revision?: string | undefined;
+            branch?: string | undefined;
+        } | {
+            type: "calendar_event";
+            when?: string | undefined;
+            attendees?: string[] | undefined;
+        } | undefined;
+    }[] | undefined;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+    nextPageToken?: string | undefined;
+}, {
+    [x: string]: unknown;
+    target: "listGoogleDocComments";
+    comments: {
+        commentId: string;
+        content: string;
+        replies: {
+            content: string;
+            action?: "resolve" | "reopen" | undefined;
+            author?: string | undefined;
+            createdTime?: string | undefined;
+        }[];
+        resolved: boolean;
+        author?: string | undefined;
+        createdTime?: string | undefined;
+        quotedText?: string | undefined;
+    }[];
+    documentId: string;
+    objectAnnotations?: {
+        kind: "object";
+        key: string;
+        label: string;
+        objectType: "code_change" | "task" | "deployment" | "calendar_event" | "automation" | "item";
+        title: string;
+        url: string | null;
+        description?: string | undefined;
+        status?: string | undefined;
+        trigger?: string | undefined;
+        warning?: string | undefined;
+        displayType?: string | undefined;
+        sourceUpdatedAt?: string | undefined;
+        facts?: {
+            type: "code_change";
+            author?: string | undefined;
+            sourceBranch?: string | undefined;
+            targetBranch?: string | undefined;
+            reviewers?: string[] | undefined;
+            review?: "required" | "approved" | "changes_requested" | undefined;
+            checks?: {
+                passed: number;
+                failed: number;
+                pending: number;
+            } | undefined;
+            mergeable?: boolean | undefined;
+            changedFiles?: number | undefined;
+            additions?: number | undefined;
+            deletions?: number | undefined;
+        } | {
+            type: "task";
+            assignees?: string[] | undefined;
+            priority?: string | undefined;
+            project?: string | undefined;
+            cycle?: string | undefined;
+            dueDate?: string | undefined;
+            labels?: string[] | undefined;
+        } | {
+            type: "deployment";
+            project?: string | undefined;
+            environment?: string | undefined;
+            revision?: string | undefined;
+            branch?: string | undefined;
+        } | {
+            type: "calendar_event";
+            when?: string | undefined;
+            attendees?: string[] | undefined;
+        } | undefined;
+    }[] | undefined;
+    truncated?: boolean | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+    nextPageToken?: string | undefined;
+}>;

package/dist/tools/read-doc.d.ts

@@ -0,0 +1,134 @@
+import type { GoogleToolContext } from "./shared";
+/**
+ * Read one Google Doc as Markdown.
+ *
+ * Drive exports the Doc, so this needs no Docs API. Comments are not in the
+ * export; `listGoogleDocComments` reads them.
+ */
+export declare function createReadGoogleDocTool(ctx: GoogleToolContext): import("@sentry/junior-plugin-api").PluginToolDefinition<{
+    document: string;
+}, {
+    [x: string]: unknown;
+    target: "readGoogleDoc";
+    content: string;
+    documentId: string;
+    title: string;
+    truncated: boolean;
+    objectAnnotations?: {
+        kind: "object";
+        key: string;
+        label: string;
+        objectType: "code_change" | "task" | "deployment" | "calendar_event" | "automation" | "item";
+        title: string;
+        url: string | null;
+        description?: string | undefined;
+        status?: string | undefined;
+        trigger?: string | undefined;
+        warning?: string | undefined;
+        displayType?: string | undefined;
+        sourceUpdatedAt?: string | undefined;
+        facts?: {
+            type: "code_change";
+            author?: string | undefined;
+            sourceBranch?: string | undefined;
+            targetBranch?: string | undefined;
+            reviewers?: string[] | undefined;
+            review?: "required" | "approved" | "changes_requested" | undefined;
+            checks?: {
+                passed: number;
+                failed: number;
+                pending: number;
+            } | undefined;
+            mergeable?: boolean | undefined;
+            changedFiles?: number | undefined;
+            additions?: number | undefined;
+            deletions?: number | undefined;
+        } | {
+            type: "task";
+            assignees?: string[] | undefined;
+            priority?: string | undefined;
+            project?: string | undefined;
+            cycle?: string | undefined;
+            dueDate?: string | undefined;
+            labels?: string[] | undefined;
+        } | {
+            type: "deployment";
+            project?: string | undefined;
+            environment?: string | undefined;
+            revision?: string | undefined;
+            branch?: string | undefined;
+        } | {
+            type: "calendar_event";
+            when?: string | undefined;
+            attendees?: string[] | undefined;
+        } | undefined;
+    }[] | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+    modifiedTime?: string | undefined;
+    url?: string | undefined;
+}, {
+    [x: string]: unknown;
+    target: "readGoogleDoc";
+    content: string;
+    documentId: string;
+    title: string;
+    truncated: boolean;
+    objectAnnotations?: {
+        kind: "object";
+        key: string;
+        label: string;
+        objectType: "code_change" | "task" | "deployment" | "calendar_event" | "automation" | "item";
+        title: string;
+        url: string | null;
+        description?: string | undefined;
+        status?: string | undefined;
+        trigger?: string | undefined;
+        warning?: string | undefined;
+        displayType?: string | undefined;
+        sourceUpdatedAt?: string | undefined;
+        facts?: {
+            type: "code_change";
+            author?: string | undefined;
+            sourceBranch?: string | undefined;
+            targetBranch?: string | undefined;
+            reviewers?: string[] | undefined;
+            review?: "required" | "approved" | "changes_requested" | undefined;
+            checks?: {
+                passed: number;
+                failed: number;
+                pending: number;
+            } | undefined;
+            mergeable?: boolean | undefined;
+            changedFiles?: number | undefined;
+            additions?: number | undefined;
+            deletions?: number | undefined;
+        } | {
+            type: "task";
+            assignees?: string[] | undefined;
+            priority?: string | undefined;
+            project?: string | undefined;
+            cycle?: string | undefined;
+            dueDate?: string | undefined;
+            labels?: string[] | undefined;
+        } | {
+            type: "deployment";
+            project?: string | undefined;
+            environment?: string | undefined;
+            revision?: string | undefined;
+            branch?: string | undefined;
+        } | {
+            type: "calendar_event";
+            when?: string | undefined;
+            attendees?: string[] | undefined;
+        } | undefined;
+    }[] | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+    modifiedTime?: string | undefined;
+    url?: string | undefined;
+}>;

package/dist/tools/search-docs.d.ts

@@ -0,0 +1,132 @@
+import { type GoogleToolContext } from "./shared";
+/** Find Google Docs that Junior's account can open, by title or text. */
+export declare function createSearchGoogleDocsTool(ctx: GoogleToolContext): import("@sentry/junior-plugin-api").PluginToolDefinition<{
+    query: string;
+    maxResults: number;
+}, {
+    [x: string]: unknown;
+    target: "searchGoogleDocs";
+    documents: {
+        documentId: string;
+        title: string;
+        modifiedTime?: string | undefined;
+        url?: string | undefined;
+    }[];
+    truncated: boolean;
+    objectAnnotations?: {
+        kind: "object";
+        key: string;
+        label: string;
+        objectType: "code_change" | "task" | "deployment" | "calendar_event" | "automation" | "item";
+        title: string;
+        url: string | null;
+        description?: string | undefined;
+        status?: string | undefined;
+        trigger?: string | undefined;
+        warning?: string | undefined;
+        displayType?: string | undefined;
+        sourceUpdatedAt?: string | undefined;
+        facts?: {
+            type: "code_change";
+            author?: string | undefined;
+            sourceBranch?: string | undefined;
+            targetBranch?: string | undefined;
+            reviewers?: string[] | undefined;
+            review?: "required" | "approved" | "changes_requested" | undefined;
+            checks?: {
+                passed: number;
+                failed: number;
+                pending: number;
+            } | undefined;
+            mergeable?: boolean | undefined;
+            changedFiles?: number | undefined;
+            additions?: number | undefined;
+            deletions?: number | undefined;
+        } | {
+            type: "task";
+            assignees?: string[] | undefined;
+            priority?: string | undefined;
+            project?: string | undefined;
+            cycle?: string | undefined;
+            dueDate?: string | undefined;
+            labels?: string[] | undefined;
+        } | {
+            type: "deployment";
+            project?: string | undefined;
+            environment?: string | undefined;
+            revision?: string | undefined;
+            branch?: string | undefined;
+        } | {
+            type: "calendar_event";
+            when?: string | undefined;
+            attendees?: string[] | undefined;
+        } | undefined;
+    }[] | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}, {
+    [x: string]: unknown;
+    target: "searchGoogleDocs";
+    documents: {
+        documentId: string;
+        title: string;
+        modifiedTime?: string | undefined;
+        url?: string | undefined;
+    }[];
+    truncated: boolean;
+    objectAnnotations?: {
+        kind: "object";
+        key: string;
+        label: string;
+        objectType: "code_change" | "task" | "deployment" | "calendar_event" | "automation" | "item";
+        title: string;
+        url: string | null;
+        description?: string | undefined;
+        status?: string | undefined;
+        trigger?: string | undefined;
+        warning?: string | undefined;
+        displayType?: string | undefined;
+        sourceUpdatedAt?: string | undefined;
+        facts?: {
+            type: "code_change";
+            author?: string | undefined;
+            sourceBranch?: string | undefined;
+            targetBranch?: string | undefined;
+            reviewers?: string[] | undefined;
+            review?: "required" | "approved" | "changes_requested" | undefined;
+            checks?: {
+                passed: number;
+                failed: number;
+                pending: number;
+            } | undefined;
+            mergeable?: boolean | undefined;
+            changedFiles?: number | undefined;
+            additions?: number | undefined;
+            deletions?: number | undefined;
+        } | {
+            type: "task";
+            assignees?: string[] | undefined;
+            priority?: string | undefined;
+            project?: string | undefined;
+            cycle?: string | undefined;
+            dueDate?: string | undefined;
+            labels?: string[] | undefined;
+        } | {
+            type: "deployment";
+            project?: string | undefined;
+            environment?: string | undefined;
+            revision?: string | undefined;
+            branch?: string | undefined;
+        } | {
+            type: "calendar_event";
+            when?: string | undefined;
+            attendees?: string[] | undefined;
+        } | undefined;
+    }[] | undefined;
+    continuation?: {
+        arguments: Record<string, unknown>;
+        reason?: string | undefined;
+    } | undefined;
+}>;

package/dist/tools/shared.d.ts

@@ -1,7 +1,7 @@
 import { type PluginEgress, type User } from "@sentry/junior-plugin-api";
 import { z } from "zod";
 import { type GoogleOperation } from "../credentials";
-/** Runtime capabilities the Calendar tools use. */
+/** Runtime capabilities the Google tools use. */
 export interface GoogleToolContext {
     /** The Workspace account Junior acts as, in lowercase. */
     accountEmail: string;
@@ -27,9 +27,15 @@ export declare function requesterEmail(ctx: GoogleToolContext): Promise<string |
  * domain. People rarely type their own address.
  */
 export declare function withRequester(ctx: GoogleToolContext, emails: string[]): Promise<string[]>;
-/** Call one Google Calendar API operation through host-owned egress. */
+/**
+ * Call one Google API operation through host-owned egress.
+ *
+ * A JSON response body is parsed. Other bodies, such as a Drive export, are
+ * returned as text.
+ */
 export declare function googleApiRequest(ctx: GoogleToolContext, input: {
     body?: unknown;
+    headers?: Record<string, string>;
     operation: GoogleOperation;
     path: string;
     query?: Record<string, string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-google",
-  "version": "0.241.0",
+  "version": "0.243.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -25,7 +25,7 @@
     "commander": "^14.0.3",
     "drizzle-orm": "^0.45.2",
     "zod": "^4.5.4",
-    "@sentry/junior-plugin-api": "0.241.0"
+    "@sentry/junior-plugin-api": "0.243.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.79.0",