@zackbart/connecta 0.32.0 → 0.34.0

package/dist/providers/ccb/index.js

@@ -25,7 +25,7 @@ import { skill } from "./skill.generated.js";
  *
  * Drift is handled the Vercel way: `src/providers/ccb/drift.json` records
  * every endpoint a named tool touches, and
- * `npm run providers:check -- --provider ccb` compares those rows with the
+ * `pnpm run providers:check --provider ccb` compares those rows with the
  * published, credential-free OpenAPI document at
  * https://docs.pushpay.io/chms-v2/openapi/chms-api-specs.json.
  */
@@ -1718,7 +1718,7 @@ function ccbConnector(id, options) {
             summary: `${environment === "sandbox" ? "Sandbox" : "Production"} CCB, ${mode === "identity" ? "per person" : "church-wide"}: id resolution, sensitive data, paging, rate limits, hatches.`,
             required: true,
         },
-        callAdmission: options.callAdmission ?? CCB_ADMISSION,
+        callAdmission: options.callAdmission === undefined ? CCB_ADMISSION : options.callAdmission,
         ...(options.maxResultBytes !== undefined ? { maxResultBytes: options.maxResultBytes } : {}),
         tools: tools(ccbTransport(endpoints.apiOrigin), defaultPerPage, writable),
     });

package/dist/providers/cloudflare/index.js

@@ -10,7 +10,7 @@ import { skill } from "./skill.generated.js";
 import { apiConnector } from "../../connectors/api-connector.js";
 import { reviewedCatalog } from "../../catalog-drift.js";
 import { keys, optionsOf, variants } from "../../config-schema.js";
-import { defineProvider } from "../../provider.js";
+import { CALL_ADMISSION, defineProvider } from "../../provider.js";
 import { byAuth, hostedOAuth } from "../_shared/rest/dispatch.js";
 import { restTools } from "../_shared/rest/tools.js";
 import { CLOUDFLARE_API_BASE, cloudflareRest } from "./rest.js";
@@ -123,7 +123,7 @@ const PIN = optionsOf()(keys("accountIds", "zoneIds"));
 const CLOUDFLARE_OPTIONS = variants(["auth", "type"], {
     oauth: optionsOf()({
         ...COMMON,
-        ...keys("callAdmission"),
+        callAdmission: CALL_ADMISSION,
         auth: optionsOf()(keys("type")),
     }).shape,
     apiToken: optionsOf()({
@@ -145,7 +145,7 @@ function cloudflareOAuth(id, options, provider) {
         url: CLOUDFLARE_MCP_ENDPOINT,
         title: options.title ?? "Cloudflare (MCP)",
         description: `Cloudflare's official whole-API MCP interface: ${options.purpose.trim()}`,
-        ...(options.callAdmission ? { callAdmission: options.callAdmission } : {}),
+        ...(options.callAdmission !== undefined ? { callAdmission: options.callAdmission } : {}),
         usageGuide: {
             content: oauthUsageGuide(options.purpose.trim(), options.instructions),
             summary: "Hosted MCP over OAuth. Search the OpenAPI document; execute programs always classify as writes.",

package/dist/providers/cloudflare/rest.js

@@ -1,9 +1,10 @@
+import { chargeConnectorCall } from "../../call-admission-context.js";
 import { retryAfterMs } from "../../connectors/guarded-fetch.js";
 import { ConnectorCallError } from "../../errors.js";
 import { OperationIndex } from "../_shared/rest/operation-index.js";
 import { callRest, restCall, restTransport, } from "../_shared/rest/tools.js";
 import { inspectGraphqlQuery } from "./graphql.js";
-import { valueSafety } from "../_shared/rest/value-safety.js";
+import { valueSafety, withholdEmbeddedUrlsIn, refuseWithheldLinks, refuseWithheldUpload, refuseWithheldBase64, } from "../_shared/rest/value-safety.js";
 import { CLOUDFLARE_VALUE_SAFETY } from "./value-safety.js";
 import { openapi } from "./openapi.generated.js";
 /** Cloudflare's v4 REST base. Override only for a proxy or a test double. */
@@ -253,7 +254,7 @@ const SAFETY = valueSafety(CLOUDFLARE_VALUE_SAFETY, () => cloudflareIndex());
  * (it may echo a submitted secret); the status and numeric codes still route.
  */
 function failureFor(status, headers, body, call) {
-    const errors = errorsOf(body);
+    const errors = errorsOf(withholdEmbeddedUrlsIn(body));
     const ray = headers.get("cf-ray");
     const codes = errorCodes(errors);
     const withheld = call !== undefined && SAFETY.withholdsErrors(call.op);
@@ -472,6 +473,7 @@ export function cloudflareRest(options) {
         let owner = owners.get(zone);
         if (owner === undefined) {
             chargeLookup(ctx);
+            await chargeConnectorCall(ctx);
             owner = await send({ method: "GET", path: `/zones/${encodeURIComponent(zone)}` }, ctx, async (response) => {
                 const body = await response.jsonResult().catch(() => ({ value: undefined }));
                 const value = "value" in body ? body.value : undefined;
@@ -491,6 +493,24 @@ export function cloudflareRest(options) {
      * neither is admitted only from the reviewed `PIN_SAFE_UNSCOPED` set.
      */
     const admit = async (call, ctx) => {
+        if (call.method !== "GET" &&
+            call.method !== "HEAD" &&
+            !READ_POSTS.some(([method, path]) => method === call.method && path === call.op.path)) {
+            refuseWithheldLinks([call.query, call.path], "Cloudflare");
+            if (call.body instanceof RawUpload)
+                await refuseWithheldUpload(call.body.body, "Cloudflare");
+            else
+                refuseWithheldLinks(call.body, "Cloudflare");
+            if (call.method === "PUT" &&
+                call.op.path === "/accounts/{account_id}/storage/kv/namespaces/{namespace_id}/bulk" &&
+                Array.isArray(call.body)) {
+                for (const entry of call.body) {
+                    // KV values support 25 MiB decoded; MAX_RESPONSE_BYTES only caps reads.
+                    if (record(entry)["base64"] === true)
+                        await refuseWithheldBase64(record(entry)["value"], "Cloudflare", 25 * 1024 * 1024);
+                }
+            }
+        }
         if (!pin)
             return;
         const { accounts, zones, template } = scopeIds(call);
@@ -632,7 +652,9 @@ export function cloudflareRest(options) {
         const info = record(body["result_info"]);
         if (Object.keys(info).length === 0)
             return undefined;
-        const cursor = text(info["cursor"]) ?? text(record(info["cursors"])["after"]);
+        const rawCursor = text(info["cursor"]) ?? text(record(info["cursors"])["after"]);
+        // Never echo or offer a modified cursor: it would not address the next page.
+        const cursor = rawCursor === undefined || withholdEmbeddedUrlsIn(rawCursor) === rawCursor ? rawCursor : undefined;
         if (cursor !== undefined || "cursor" in info || "cursors" in info) {
             const accepted = operations.contract(call.op).parameters.map((parameter) => parameter.name);
             const param = accepted.includes("cursor") ? "cursor" : accepted.includes("after") ? "after" : "cursor";

package/dist/providers/cloudflare/skill.generated.js

@@ -6,7 +6,7 @@ export const skill = {
         "oauth": "\n\n- The catalog is Cloudflare's own `search` and `execute`. `search` runs code against Cloudflare's OpenAPI document; `execute` runs code that may call any Cloudflare API endpoint the OAuth grant allows.\n- Connecta classifies `execute` as a write, even for a program that only reads, because one program can mix GET, POST, PUT, PATCH, and DELETE and no schema proves otherwise. A read-only endpoint therefore gets only `search` here. Deployments that need API reads from a read-only endpoint configure an API-token connector, whose `cloudflare_api_read` and named reads are reads.\n- Use `search` to find the exact method, path, and fields before writing an execute program. Do not guess an endpoint from product naming.\n- Keep returned values small. Filter and project inside the Cloudflare program, then reduce again inside Connecta's `execute_code` when several calls must be joined.\n- This connection has none of the REST connector's tools: no `cloudflare_api_*` validation against a pinned index, no `graphql_query`, no `cloudflare_api_upload`, and no account or zone pin. OAuth permissions are the boundary.\n",
         "oauth_tail": "- An `auth_required` failure means this connector's Cloudflare authorization is missing or expired: run `authorize_connector` for this connector id, then retry the same call unchanged.\n",
         "global_warning": "\n\nThis connector holds a Global API Key. It acts as its Cloudflare user with every permission that user has, in every account and zone the user belongs to, and nothing on Cloudflare's side narrows it. A mistaken write can reach production domains, billing, and members across all of them. Prefer reads, state the account and zone of every write, and stop when a request is ambiguous. Writes under `/user` and `/memberships` are refused. R2 accepts API tokens only, so R2 operations fail with this key.\n",
-        "key": "\n\n- This is Connecta's REST connector to the Cloudflare v4 API, holding one operator-managed credential. `cloudflare_api_search` finds API operations in a pinned index (not records) and names the tool that calls each; `cloudflare_api_details` returns one operation's parameters and body with types, enums, and required names. Neither sends a request.\n- `cloudflare_api_read` calls GET operations plus reviewed read-only POSTs: analytics queries, Analytics Engine and SQL API queries, Log Explorer SQL, Vectorize queries, KV bulk get, telemetry queries, and validation checks. `cloudflare_api_write` calls every other POST, PUT, PATCH, and DELETE with `method` and `path` stated. D1 `…/query` and `…/raw`, Durable Object queries, Workers AI `…/ai/run`, AI Search and AutoRAG search (query rewriting runs billed models), monetization checks, and flag evaluation are writes: they can change data, cost money, or activate something.\n- Paths are concrete: substitute ids into the template search returned (`/zones/<zone id>/dns_records/<record id>`). Pass `query` and `body` as JSON named as details lists them; text operations (Analytics Engine SQL, Log Explorer SQL, Worker scripts) take a string body, and Vectorize inserts a list of objects sent as NDJSON. R2 calls accept `headers` with `cf-r2-jurisdiction` or `cf-r2-storage-class`. Encode a `/` inside an R2 object key or KV key name as `%2F`.\n- Every call is checked against the pinned index before it is sent. An unknown path returns the nearest operations; an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Cloudflare, so fix the call from that answer.\n- Results arrive as `{ status, data, page? }` with Cloudflare's envelope unwrapped: `data` is the `result`. On a list, pass `page.next` as the `page.param` query argument (`page` for numbered lists, `cursor` for KV, R2, and other cursor lists). Lists belong inside `execute_code`; pass `select` (dot paths such as `id` and `name`) to keep only the fields the question needs.\n- `list_zones` and `list_accounts` resolve names to ids; `verify_credential` separates a bad credential from a missing permission. `graphql_query` runs read-only GraphQL Analytics queries (mutations are refused before sending); filter every `zones` or `accounts` field by `zoneTag` or `accountTag`. A pinned connector sends one query per document, with every fragment it defines used.\n- Multipart, binary, and file bodies go through `cloudflare_api_upload`: Worker scripts and versions, KV values, R2 objects, Pages deployments, Images, Stream, DNS zone-file import, and Snippets. It takes `textBody`, `base64Body`, or multipart `parts`, never a local file.\n- Refused by design: every operation that mints, rotates, or hands back a credential (API tokens, Access service tokens, R2 temporary credentials, tunnel and Mesh node tokens, signing keys, registry credentials, direct-upload URLs, deploy hooks, preview and participant tokens), payment client secrets, URL Scanner captures (results, HAR, DOM, raw responses: they hold the scanned session's cookies and headers; use the scan search for verdicts), and GETs that act (an email unsubscribe, a PagerDuty connect). Stored and embedded secrets (Turnstile, TSIG, webhook and identity-provider secrets, Stream keys, Logpush destination credentials, probe and custom-provider headers, BGP keys, Zaraz variables, Hyperdrive database passwords, RealtimeKit storage credentials, transform-rule header values) and every environment or plain-text binding value (Pages, Containers, Workers, Builds; names and types stay) come back as `\"[redacted]\"` on every method. Notification, RealtimeKit, and data security webhook destinations keep only their scheme and host. Workers KV values are application data and come back as stored. Reviewed operations, and operations that take credentials, report Cloudflare's error codes without its error text. Worker script content is readable: it is code, and secret bindings are not part of it.\n- An `auth_required` failure means the credential is missing, revoked, or malformed: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. `provider_permission_denied` means the credential works but lacks this permission or resource, or the call is outside the pin; ask rather than retry.\n",
+        "key": "\n\n- This is Connecta's REST connector to the Cloudflare v4 API, holding one operator-managed credential. `cloudflare_api_search` finds API operations in a pinned index (not records) and names the tool that calls each; `cloudflare_api_details` returns one operation's parameters and body with types, enums, and required names. Neither sends a request.\n- `cloudflare_api_read` calls GET operations plus reviewed read-only POSTs: analytics queries, Analytics Engine and SQL API queries, Log Explorer SQL, Vectorize queries, KV bulk get, telemetry queries, and validation checks. `cloudflare_api_write` calls every other POST, PUT, PATCH, and DELETE with `method` and `path` stated. D1 `…/query` and `…/raw`, Durable Object queries, Workers AI `…/ai/run`, AI Search and AutoRAG search (query rewriting runs billed models), monetization checks, and flag evaluation are writes: they can change data, cost money, or activate something.\n- Paths are concrete: substitute ids into the template search returned (`/zones/<zone id>/dns_records/<record id>`). Pass `query` and `body` as JSON named as details lists them; text operations (Analytics Engine SQL, Log Explorer SQL, Worker scripts) take a string body, and Vectorize inserts a list of objects sent as NDJSON. R2 calls accept `headers` with `cf-r2-jurisdiction` or `cf-r2-storage-class`. Encode a `/` inside an R2 object key or KV key name as `%2F`.\n- Every call is checked against the pinned index before it is sent. An unknown path returns the nearest operations; an unknown or missing parameter returns `validation.issues` with the accepted names. Nothing reached Cloudflare, so fix the call from that answer.\n- Under an account pin, each uncached zone-ownership check also spends the connector's call budget. Checks stay capped at three per call and 60 per five minutes per connector; an exhausted budget stops the check and the requested operation.\n- Results arrive as `{ status, data, page? }` with Cloudflare's envelope unwrapped: `data` is the `result`. On a list, pass `page.next` as the `page.param` query argument (`page` for numbered lists, `cursor` for KV, R2, and other cursor lists). Lists belong inside `execute_code`; pass `select` (dot paths such as `id` and `name`) to keep only the fields the question needs.\n- `list_zones` and `list_accounts` resolve names to ids; `verify_credential` separates a bad credential from a missing permission. `graphql_query` runs read-only GraphQL Analytics queries (mutations are refused before sending); filter every `zones` or `accounts` field by `zoneTag` or `accountTag`. A pinned connector sends one query per document, with every fragment it defines used.\n- Multipart, binary, and file bodies go through `cloudflare_api_upload`: Worker scripts and versions, KV values, R2 objects, Pages deployments, Images, Stream, DNS zone-file import, and Snippets. It takes `textBody`, `base64Body`, or multipart `parts`, never a local file.\n- Refused by design: every operation that mints, rotates, or hands back a credential (API tokens, Access service tokens, R2 temporary credentials, tunnel and Mesh node tokens, signing keys, registry credentials, direct-upload URLs, deploy hooks, preview and participant tokens), payment client secrets, URL Scanner captures (results, HAR, DOM, raw responses: they hold the scanned session's cookies and headers; use the scan search for verdicts), and GETs that act (an email unsubscribe, a PagerDuty connect). Stored and embedded secrets (Turnstile, TSIG, webhook and identity-provider secrets, Stream keys, Logpush destination credentials, probe and custom-provider headers, BGP keys, Zaraz variables, Hyperdrive database passwords, RealtimeKit storage credentials, transform-rule header values) and every environment or plain-text binding value (Pages, Containers, Workers, Builds; names and types stay) come back as `\"[redacted]\"` on every method. Notification, RealtimeKit, and data security webhook destinations keep only their scheme and host. Workers KV values are application data and come back as stored. Reviewed operations, and operations that take credentials, report Cloudflare's error codes without its error text. Worker script content is readable: it is code, and secret bindings are not part of it.\n- An `auth_required` failure means the credential is missing, revoked, or malformed: an operator must replace it in this connection in the operator UI, and `authorize_connector` returns that handoff. `provider_permission_denied` means the credential works but lacks this permission or resource, or the call is outside the pin; ask rather than retry.\n- Embedded URL safety uses reviewed paths plus global signing parameters. Generic credential-named query parameters (`code`, `key`, `token`, `sig`, etc.) and credential-looking fragments withhold the destination's entire query/fragment only in Workers build `lines`, Pages log `data.line`, and telemetry `$metadata.message`/`error` and raw string/object `source` payloads in both `events.events` and `invocations.*` on the reviewed log operations and vendor error text. Ordinary `code`/`key` links can therefore be false positives in these diagnostics. DNS TXT content, KV values, Access/Waiting Room custom HTML and other operator content keep those ordinary URL parameters byte for byte. Literal AWS SigV4/Google V4 `X-Amz-*`/`X-Goog-*` Signature, Credential and Security-Token values are withheld in every decoded string before projection. A withheld value is not the original: do not write it back. KV bulk writes also inspect decoded `value` fields with `base64: true` (up to Cloudflare's 25 MiB decoded value limit; malformed or oversized base64 is refused, and the host's inbound body cap still applies). All writes, including named writes and supported raw/base64/multipart uploads, reject URL destinations whose own query/fragment contains the exact `[redacted]` placeholder, plain or encoded, with `invalid_args` before dispatch. Admission iteratively checks every JSON key and value within the host's accepted request size, without separate depth or node-count ceilings; cyclic direct arguments are refused. A marker outside the destination remains ordinary text. Split strings, encoded host/signing names, bare hosts without `//`, and opaque bearer paths remain outside this scan. Binary responses represented as base64, including Worker JavaScript served as `application/javascript`, are returned unchanged and are not decoded/scanned. An envelope cursor that would change under URL sanitizing is omitted rather than echoed or reused.\n",
         "shared": "- Resolve account and zone ids before acting; never guess one. Ids are 32-character hex strings, and a zone is found by its domain name. Defaults and pins route a connector; Cloudflare's permissions still decide what the credential may do.\n- Read state before replacing, rolling back, or purging. For DNS, PATCH changes the fields you send and PUT replaces the whole record, so read the record first and send its type, name, and content with the change. Prefer a targeted cache purge (files, tags, hosts, or prefixes) over purging everything.\n- Cloudflare reports failures in `errors` with numeric codes and returns `success: false`; read the message instead of retrying the same call.\n- Honor rate-limit waits. Cloudflare documents 1,200 requests per five minutes per user, counted across the dashboard and every token; Connecta's per-runtime window approximates it, and a limited user is blocked for the rest of the window.\n- Treat every create, update, delete, purge, deploy, and upload as a write. For guest calls, classification, and routing, fetch `skills({ name: \"usage\" })`.\n",
         "key_tail": "- Cloudflare answers a rate limit with HTTP 429; the failure carries `retryAfterMs`. Failed authentication is limited separately (code 10502), so diagnose a credential once with `verify_credential` rather than retrying calls.\n"
     }

package/dist/providers/cloudflare/value-safety.js

@@ -15,6 +15,22 @@
 // Paths are dot paths into the data a tool returns (Cloudflare's `result`,
 // or the whole body when it is not an envelope); lists are traversed
 // implicitly and `*` matches every key of an object.
+// Embedded URL verdict (#812): reviewed paths + global signing parameters.
+// Evidence: digest-verified schema revision 3fad73eb27c381031c09ccdfa28ef9352029cd5a:
+// builds_BuildLogsResponse.lines (timestamp/log-message tuples),
+// pages_deployment_log.data.line and workers-observability_query_results
+// events.events and invocations.* -> telemetry_event.$metadata.message/error
+// and source (raw string/object log payload). Exact operations
+// and paths are below, after envelope unwrapping. All vendor error text is
+// scanned too; ordinary code/key links can be false positives in diagnostics.
+// DNS TXT content, KV values, Access custom_html, Waiting Room custom_page_html
+// and other operator/application content retain generic query parameters.
+// Literal X-Amz-/X-Goog- Signature/Credential/Security-Token values are withheld
+// in every decoded string. Binary/base64 response bodies (including Worker
+// JavaScript served as application/javascript) are not decoded or scanned.
+// Recording/download/upload capabilities retain their structured-field rules.
+// The review found no documented Cloudflare-minted links embedded in other
+// free text and justifies no Cloudflare/R2/S3-wide file-host policy.
 import { redact as reviewed, refuse, safe as reviewedSafe, } from "../_shared/rest/value-safety.js";
 const MINT = "Connecta does not create, rotate, or return credentials; an operator manages this credential in the Cloudflare dashboard.";
 const API_TOKENS = "Connecta does not create, roll, edit, or delete API tokens; an operator manages tokens in the Cloudflare dashboard.";
@@ -1152,6 +1168,22 @@ const OPERATIONS = {
  * are reviewed metadata wherever they appear.
  */
 export const CLOUDFLARE_VALUE_SAFETY = {
+    embeddedUrls: {
+        operations: {
+            "GET /accounts/{account_id}/builds/builds/{build_uuid}/logs": ["lines"],
+            "GET /accounts/{account_id}/pages/projects/{project_name}/deployments/{deployment_id}/history/logs": [
+                "data.line",
+            ],
+            "POST /accounts/{account_id}/workers/observability/telemetry/query": [
+                "events.events.$metadata.message",
+                "events.events.$metadata.error",
+                "events.events.source",
+                "invocations.*.$metadata.message",
+                "invocations.*.$metadata.error",
+                "invocations.*.source",
+            ],
+        },
+    },
     title: "Cloudflare",
     operations: OPERATIONS,
     fields: {

package/dist/providers/docs/index.js

@@ -21,12 +21,12 @@ import { skill } from "./skill.generated.js";
  *
  * Drift. Google publishes a credential-free Discovery document per API.
  * `src/providers/docs/drift.json` records the three methods the tools
- * call, and `npm run providers:check -- --provider docs` reports a touched
+ * call, and `pnpm run providers:check --provider docs` reports a touched
  * contract that moved or a method that stopped accepting the scope below.
  */
 import { apiConnector as api, defined } from "../../connectors/api-connector.js";
 import { ConnectorCallError } from "../../errors.js";
-import { googleOutcomeOf, GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, } from "../_shared/google/workspace.js";
+import { googleOutcomeOf, GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, workspaceConnector, } from "../_shared/google/workspace.js";
 import { RESULT_BUDGET_BYTES, clampText, jsonBytes } from "../_shared/google/result-size.js";
 import { asProviderFactory } from "../../provider.js";
 /**
@@ -1218,7 +1218,7 @@ function docsConnector(id, options) {
         notFound: "ambiguous",
         connection,
     });
-    return api(id, {
+    return workspaceConnector(connection, api(id, {
         ...defined({
             callAdmission: options.callAdmission,
             maxResultBytes: options.maxResultBytes,
@@ -1233,5 +1233,5 @@ function docsConnector(id, options) {
             required: true,
         },
         tools: tools(client),
-    });
+    }));
 }

package/dist/providers/docs/skill.generated.js

@@ -1,9 +1,9 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "# Google Docs usage\n\nReads and edits Google Docs as the signed-in person through Workspace delegation; it cannot search or list documents.\n\nConnection purpose: \n\n## Whose documents\n\nEvery call acts as the Workspace account deployment config maps the caller\nto, and reaches exactly the documents Drive shares with that person. No\nargument names an account. A call with none mapped fails `auth_required`;\nonly an operator can change the mapping.\n\n## Finding a document\n\nThere is no search or list tool. Take the id from a\ndocs.google.com URL (the part after `/d/`), from the person, or from a\nGoogle Drive connection's file search. A failure on an id may mean it does\nnot exist or is not shared with this person; Google does not say which.\n\n## Reading\n\n- `get_document` renders every tab as markdown-ish text: headings, lists,\n  links, tables as pipe rows, footnotes after the body, images and other\n  embeds as bracketed markers. Headers, footers, floating images, and\n  comments are not rendered; a tab's `notRendered` names any it holds, and\n  `suggestion_marks` there means the text mixes unmarked suggested\n  insertions and deletions in (read with `suggestions` to preview). Text past `maxChars` (shared across tabs) ends with a marker;\n  pass `tabId` to read one tab.\n- Before an index-based edit, read with `withIndexes: true` and target an\n  element's `startIndex`/`endIndex`. A long document's rows page with\n  `page.nextCursor`; send `maxChars: 0` on later pages, and start over if\n  `revisionId` changed between them. Indexes are UTF-16 code units and\n  shift after every edit. Keep `revisionId` and pass it as\n  `requiredRevisionId`, so an edit against a document someone else has\n  changed fails `conflict` with nothing applied; re-read and recompute. Indexes\n  from a suggestions preview (`accepted`/`rejected`) are not valid for\n  edits.\n- `raw: true` returns Google's document resource for the tabs instead of\n  the rendering — styles, headers, footers, named ranges, list and segment ids\n  that `batch_update_document` requests may need. It is large: pass\n  `tabId`, and call it directly rather than inside `execute_code`,\n  which carries at most 256 KiB per result.\n- The same holds for a `maxChars` above the default: a long rendering\n  can pass here and still be refused inside `execute_code`, even when the\n  program would only measure it. Read it with a direct `call_tool`, paged\n  with `connecta.result`, or read one tab at a time.\n\n## Editing\n\n- `create_document` makes a new document in My Drive's root. Never create\n  again after a failure that may have left one behind; the message says\n  which. When the document exists but its starting text failed, the message\n  names its id: append the text with `append_text` straight away only when\n  Google refused it; otherwise read the document first and append only what\n  is missing.\n- An edit sent with no answer back, answered with a server error, or\n  redirected says its outcome is unknown: re-read before repeating it, or\n  repeat it with the same `requiredRevisionId`, which Google refuses if the\n  first attempt landed. One Google answered 2xx whose reply was unreadable\n  says it was applied: do not repeat it.\n- `append_text` joins the last paragraph; begin with `\\n` for a new one.\n- `replace_all_text` changes every match at once; read first and make\n  `find` specific.\n- `batch_update_document` takes raw Docs API requests (`deleteContentRange`,\n  `updateTextStyle`, `insertTable`, `createParagraphBullets`, …) for what\n  the named tools cannot do. It is always destructive, and requires the\n  `requiredRevisionId` from the read it was planned against: up to 100\n  requests, each exactly one generally available kind (the Developer Preview\n  comment and suggestion kinds are refused). Several requests in one\n  call apply atomically, and each sees the index shifts of those before it;\n  order deletions from the end of the document backwards.\n",
+    "content": "# Google Docs usage\n\nReads and edits Google Docs as the signed-in person through Workspace delegation; it cannot search or list documents.\n\nConnection purpose: \n\n## Whose documents\n\nEvery call acts as the Workspace account deployment config maps the caller\nto, and reaches exactly the documents Drive shares with that person; an\nagent acts as the owner of the pool it came through, unless the deployment fixes one shared account that every caller, agent or person, acts as. No argument names an\naccount. A call with none mapped fails `auth_required`; only an operator can change\nthat.\n\n## Finding a document\n\nThere is no search or list tool. Take the id from a\ndocs.google.com URL (the part after `/d/`), from the person, or from a\nGoogle Drive connection's file search. A failure on an id may mean it does\nnot exist or is not shared with this person; Google does not say which.\n\n## Reading\n\n- `get_document` renders every tab as markdown-ish text: headings, lists,\n  links, tables as pipe rows, footnotes after the body, images and other\n  embeds as bracketed markers. Headers, footers, floating images, and\n  comments are not rendered; a tab's `notRendered` names any it holds, and\n  `suggestion_marks` there means the text mixes unmarked suggested\n  insertions and deletions in (read with `suggestions` to preview). Text past `maxChars` (shared across tabs) ends with a marker;\n  pass `tabId` to read one tab.\n- Before an index-based edit, read with `withIndexes: true` and target an\n  element's `startIndex`/`endIndex`. A long document's rows page with\n  `page.nextCursor`; send `maxChars: 0` on later pages, and start over if\n  `revisionId` changed between them. Indexes are UTF-16 code units and\n  shift after every edit. Keep `revisionId` and pass it as\n  `requiredRevisionId`, so an edit against a document someone else has\n  changed fails `conflict` with nothing applied; re-read and recompute. Indexes\n  from a suggestions preview (`accepted`/`rejected`) are not valid for\n  edits.\n- `raw: true` returns Google's document resource for the tabs instead of\n  the rendering — styles, headers, footers, named ranges, list and segment ids\n  that `batch_update_document` requests may need. It is large: pass\n  `tabId`, and call it directly rather than inside `execute_code`,\n  which carries at most 256 KiB per result.\n- The same holds for a `maxChars` above the default: a long rendering\n  can pass here and still be refused inside `execute_code`, even when the\n  program would only measure it. Read it with a direct `call_tool`, paged\n  with `connecta.result`, or read one tab at a time.\n\n## Editing\n\n- `create_document` makes a new document in My Drive's root. Never create\n  again after a failure that may have left one behind; the message says\n  which. When the document exists but its starting text failed, the message\n  names its id: append the text with `append_text` straight away only when\n  Google refused it; otherwise read the document first and append only what\n  is missing.\n- An edit sent with no answer back, answered with a server error, or\n  redirected says its outcome is unknown: re-read before repeating it, or\n  repeat it with the same `requiredRevisionId`, which Google refuses if the\n  first attempt landed. One Google answered 2xx whose reply was unreadable\n  says it was applied: do not repeat it.\n- `append_text` joins the last paragraph; begin with `\\n` for a new one.\n- `replace_all_text` changes every match at once; read first and make\n  `find` specific.\n- `batch_update_document` takes raw Docs API requests (`deleteContentRange`,\n  `updateTextStyle`, `insertTable`, `createParagraphBullets`, …) for what\n  the named tools cannot do. It is always destructive, and requires the\n  `requiredRevisionId` from the read it was planned against: up to 100\n  requests, each exactly one generally available kind (the Developer Preview\n  comment and suggestion kinds are refused). Several requests in one\n  call apply atomically, and each sees the index shifts of those before it;\n  order deletions from the end of the document backwards.\n",
     "instructionsHeading": "Connection instructions",
     "fragments": {
         "guide_0": "# Google Docs usage\n\nReads and edits Google Docs as the signed-in person through Workspace delegation; it cannot search or list documents.\n\nConnection purpose: ",
-        "guide_1": "\n\n## Whose documents\n\nEvery call acts as the Workspace account deployment config maps the caller\nto, and reaches exactly the documents Drive shares with that person. No\nargument names an account. A call with none mapped fails `auth_required`;\nonly an operator can change the mapping.\n\n## Finding a document\n\nThere is no search or list tool. Take the id from a\ndocs.google.com URL (the part after `/d/`), from the person, or from a\nGoogle Drive connection's file search. A failure on an id may mean it does\nnot exist or is not shared with this person; Google does not say which.\n\n## Reading\n\n- `get_document` renders every tab as markdown-ish text: headings, lists,\n  links, tables as pipe rows, footnotes after the body, images and other\n  embeds as bracketed markers. Headers, footers, floating images, and\n  comments are not rendered; a tab's `notRendered` names any it holds, and\n  `suggestion_marks` there means the text mixes unmarked suggested\n  insertions and deletions in (read with `suggestions` to preview). Text past `maxChars` (shared across tabs) ends with a marker;\n  pass `tabId` to read one tab.\n- Before an index-based edit, read with `withIndexes: true` and target an\n  element's `startIndex`/`endIndex`. A long document's rows page with\n  `page.nextCursor`; send `maxChars: 0` on later pages, and start over if\n  `revisionId` changed between them. Indexes are UTF-16 code units and\n  shift after every edit. Keep `revisionId` and pass it as\n  `requiredRevisionId`, so an edit against a document someone else has\n  changed fails `conflict` with nothing applied; re-read and recompute. Indexes\n  from a suggestions preview (`accepted`/`rejected`) are not valid for\n  edits.\n- `raw: true` returns Google's document resource for the tabs instead of\n  the rendering — styles, headers, footers, named ranges, list and segment ids\n  that `batch_update_document` requests may need. It is large: pass\n  `tabId`, and call it directly rather than inside `execute_code`,\n  which carries at most 256 KiB per result.\n- The same holds for a `maxChars` above the default: a long rendering\n  can pass here and still be refused inside `execute_code`, even when the\n  program would only measure it. Read it with a direct `call_tool`, paged\n  with `connecta.result`, or read one tab at a time.\n\n## Editing\n\n- `create_document` makes a new document in My Drive's root. Never create\n  again after a failure that may have left one behind; the message says\n  which. When the document exists but its starting text failed, the message\n  names its id: append the text with `append_text` straight away only when\n  Google refused it; otherwise read the document first and append only what\n  is missing.\n- An edit sent with no answer back, answered with a server error, or\n  redirected says its outcome is unknown: re-read before repeating it, or\n  repeat it with the same `requiredRevisionId`, which Google refuses if the\n  first attempt landed. One Google answered 2xx whose reply was unreadable\n  says it was applied: do not repeat it.\n- `append_text` joins the last paragraph; begin with `\\n` for a new one.\n- `replace_all_text` changes every match at once; read first and make\n  `find` specific.\n- `batch_update_document` takes raw Docs API requests (`deleteContentRange`,\n  `updateTextStyle`, `insertTable`, `createParagraphBullets`, …) for what\n  the named tools cannot do. It is always destructive, and requires the\n  `requiredRevisionId` from the read it was planned against: up to 100\n  requests, each exactly one generally available kind (the Developer Preview\n  comment and suggestion kinds are refused). Several requests in one\n  call apply atomically, and each sees the index shifts of those before it;\n  order deletions from the end of the document backwards.\n"
+        "guide_1": "\n\n## Whose documents\n\nEvery call acts as the Workspace account deployment config maps the caller\nto, and reaches exactly the documents Drive shares with that person; an\nagent acts as the owner of the pool it came through, unless the deployment fixes one shared account that every caller, agent or person, acts as. No argument names an\naccount. A call with none mapped fails `auth_required`; only an operator can change\nthat.\n\n## Finding a document\n\nThere is no search or list tool. Take the id from a\ndocs.google.com URL (the part after `/d/`), from the person, or from a\nGoogle Drive connection's file search. A failure on an id may mean it does\nnot exist or is not shared with this person; Google does not say which.\n\n## Reading\n\n- `get_document` renders every tab as markdown-ish text: headings, lists,\n  links, tables as pipe rows, footnotes after the body, images and other\n  embeds as bracketed markers. Headers, footers, floating images, and\n  comments are not rendered; a tab's `notRendered` names any it holds, and\n  `suggestion_marks` there means the text mixes unmarked suggested\n  insertions and deletions in (read with `suggestions` to preview). Text past `maxChars` (shared across tabs) ends with a marker;\n  pass `tabId` to read one tab.\n- Before an index-based edit, read with `withIndexes: true` and target an\n  element's `startIndex`/`endIndex`. A long document's rows page with\n  `page.nextCursor`; send `maxChars: 0` on later pages, and start over if\n  `revisionId` changed between them. Indexes are UTF-16 code units and\n  shift after every edit. Keep `revisionId` and pass it as\n  `requiredRevisionId`, so an edit against a document someone else has\n  changed fails `conflict` with nothing applied; re-read and recompute. Indexes\n  from a suggestions preview (`accepted`/`rejected`) are not valid for\n  edits.\n- `raw: true` returns Google's document resource for the tabs instead of\n  the rendering — styles, headers, footers, named ranges, list and segment ids\n  that `batch_update_document` requests may need. It is large: pass\n  `tabId`, and call it directly rather than inside `execute_code`,\n  which carries at most 256 KiB per result.\n- The same holds for a `maxChars` above the default: a long rendering\n  can pass here and still be refused inside `execute_code`, even when the\n  program would only measure it. Read it with a direct `call_tool`, paged\n  with `connecta.result`, or read one tab at a time.\n\n## Editing\n\n- `create_document` makes a new document in My Drive's root. Never create\n  again after a failure that may have left one behind; the message says\n  which. When the document exists but its starting text failed, the message\n  names its id: append the text with `append_text` straight away only when\n  Google refused it; otherwise read the document first and append only what\n  is missing.\n- An edit sent with no answer back, answered with a server error, or\n  redirected says its outcome is unknown: re-read before repeating it, or\n  repeat it with the same `requiredRevisionId`, which Google refuses if the\n  first attempt landed. One Google answered 2xx whose reply was unreadable\n  says it was applied: do not repeat it.\n- `append_text` joins the last paragraph; begin with `\\n` for a new one.\n- `replace_all_text` changes every match at once; read first and make\n  `find` specific.\n- `batch_update_document` takes raw Docs API requests (`deleteContentRange`,\n  `updateTextStyle`, `insertTable`, `createParagraphBullets`, …) for what\n  the named tools cannot do. It is always destructive, and requires the\n  `requiredRevisionId` from the read it was planned against: up to 100\n  requests, each exactly one generally available kind (the Developer Preview\n  comment and suggestion kinds are refused). Several requests in one\n  call apply atomically, and each sees the index shifts of those before it;\n  order deletions from the end of the document backwards.\n"
     }
 };

package/dist/providers/drive/index.js

@@ -26,14 +26,14 @@ import { skill } from "./skill.generated.js";
  * changes sharing is destructive and crosses the host's approval prompt.
  *
  * Drift. `src/providers/drive/drift.json` records the eleven methods the
- * tools call, and `npm run providers:check -- --provider drive` reports a
+ * tools call, and `pnpm run providers:check --provider drive` reports a
  * touched contract that moved or a method that stopped accepting the scope
  * below.
  */
 import { apiConnector as api, defined } from "../../connectors/api-connector.js";
 import { ConnectorCallError } from "../../errors.js";
 import { RESULT_BUDGET_BYTES, clampText, jsonBytes } from "../_shared/google/result-size.js";
-import { googleOutcomeOf, GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, } from "../_shared/google/workspace.js";
+import { googleOutcomeOf, GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, workspaceConnector, } from "../_shared/google/workspace.js";
 import { asProviderFactory } from "../../provider.js";
 /**
  * Drive's API root. Uploads use the same path beneath `/upload` on the same
@@ -1504,7 +1504,7 @@ function driveConnector(id, options) {
     };
     const client = googleWorkspaceClient({ ...shared, baseUrl });
     const upload = googleWorkspaceClient({ ...shared, baseUrl: uploadBaseUrl(baseUrl) });
-    return api(id, {
+    return workspaceConnector(connection, api(id, {
         ...defined({
             callAdmission: options.callAdmission,
             maxResultBytes: options.maxResultBytes,
@@ -1519,5 +1519,5 @@ function driveConnector(id, options) {
             required: true,
         },
         tools: guarded(tools(client, upload)),
-    });
+    }));
 }

package/dist/providers/drive/skill.generated.js

@@ -1,9 +1,9 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "# Google Drive usage\n\nActs as the signed-in person's own Google Drive through Workspace delegation: what they can open, and nothing they cannot.\n\nConnection purpose: \n\n## Whose Drive\n\nEvery call acts as the Workspace address deployment config maps the caller\nto, and reaches exactly the files that person can open, shared drives\nincluded. No argument names an account. A call with none mapped fails\n`auth_required`; only an operator can change the mapping. A missing file\nand one this person cannot see fail alike — Google does not distinguish them.\n\n## Finding files\n\n- `search_files` takes Drive query syntax: `name contains 'x'`,\n  `fullText contains 'x'`, `mimeType = '…'`, `'<folderId>' in parents`,\n  `modifiedTime > '2026-01-01T00:00:00'`. Quote values with single quotes.\n  Trashed files are left out unless `includeTrashed`. `incompleteSearch:\n  true` means Drive gave up before searching everything; narrow the query or\n  the corpus. Shared drives: `list_shared_drives`, then `corpora: \"drive\"`\n  with its `driveId`.\n- Page with `page.nextCursor` and the same arguments; a cursor from another\n  tool or other arguments is refused. A page can stop short of `limit` to\n  stay under `maxBytes`; the cursor resumes at the first row left out, and\n  fails `conflict` if that page changed meanwhile — start over then.\n- Ids come from these reads or a Drive URL (`/d/<id>/`, `/folders/<id>`);\n  never guess one.\n\n## Reading content\n\n- `get_file_content` exports Docs as Markdown, Sheets as CSV of the\n  **first sheet only**, and Slides as plain text; reads text files as text;\n  and returns other files as base64 when the encoded file fits the result. Anything else — a\n  larger binary, a drawing, a form, a folder, a shortcut — comes back as\n  `format: \"unavailable\"` with a `note`, never as an empty success.\n- Text is capped by `maxChars`; a cut ends with a truncation marker and\n  `contentTruncated: true`. Drive exports at most 10 MB.\n- Every read stays under `maxBytes` of JSON. The default is what one result\n  can carry into `execute_code`, so a program always receives it. A larger\n  `maxBytes` (up to 4 MiB — a binary of up to 1 MiB) reaches only a direct\n  `call_tool`, which pages it with `connecta.result`.\n\n## Writing\n\n- `create_folder` and `restore_file` add without losing or exposing\n  anything.\n- A new file takes its folder's sharing, not its source's: `create_file`\n  and `copy_file` into a shared folder disclose that content to everyone\n  the folder is shared with, so both are approved like any destructive write.\n  Check the destination with `list_permissions` first. `convertTo`\n  imports content as a Google Doc, Sheet, or Slides file.\n- `update_file_content` replaces the whole content; send all of it.\n  `update_file` renames; `move_file` changes the folder and with it who\n  inherits access.\n- `trash_file` is recoverable for 30 days with `restore_file`. There is no\n  permanent delete and no ownership transfer.\n- `share_file` emails no one unless `sendNotificationEmail: true`. Check\n  `list_permissions` before and after changing access, and confirm with the\n  person before sharing with `anyone` or a whole domain.\n",
+    "content": "# Google Drive usage\n\nActs as the signed-in person's own Google Drive through Workspace delegation: what they can open, and nothing they cannot.\n\nConnection purpose: \n\n## Whose Drive\n\nEvery call acts as the Workspace address deployment config maps the caller\nto, and reaches exactly the files that person can open, shared drives\nincluded; an agent acts as the owner of the pool it came through, unless the deployment fixes one shared account that every caller, agent or person, acts as. No\nargument names an account. A call with none mapped fails `auth_required`; only an operator can change\nthat. A missing file\nand one this person cannot see fail alike — Google does not distinguish them.\n\n## Finding files\n\n- `search_files` takes Drive query syntax: `name contains 'x'`,\n  `fullText contains 'x'`, `mimeType = '…'`, `'<folderId>' in parents`,\n  `modifiedTime > '2026-01-01T00:00:00'`. Quote values with single quotes.\n  Trashed files are left out unless `includeTrashed`. `incompleteSearch:\n  true` means Drive gave up before searching everything; narrow the query or\n  the corpus. Shared drives: `list_shared_drives`, then `corpora: \"drive\"`\n  with its `driveId`.\n- Page with `page.nextCursor` and the same arguments; a cursor from another\n  tool or other arguments is refused. A page can stop short of `limit` to\n  stay under `maxBytes`; the cursor resumes at the first row left out, and\n  fails `conflict` if that page changed meanwhile — start over then.\n- Ids come from these reads or a Drive URL (`/d/<id>/`, `/folders/<id>`);\n  never guess one.\n\n## Reading content\n\n- `get_file_content` exports Docs as Markdown, Sheets as CSV of the\n  **first sheet only**, and Slides as plain text; reads text files as text;\n  and returns other files as base64 when the encoded file fits the result. Anything else — a\n  larger binary, a drawing, a form, a folder, a shortcut — comes back as\n  `format: \"unavailable\"` with a `note`, never as an empty success.\n- Text is capped by `maxChars`; a cut ends with a truncation marker and\n  `contentTruncated: true`. Drive exports at most 10 MB.\n- Every read stays under `maxBytes` of JSON. The default is what one result\n  can carry into `execute_code`, so a program always receives it. A larger\n  `maxBytes` (up to 4 MiB — a binary of up to 1 MiB) reaches only a direct\n  `call_tool`, which pages it with `connecta.result`.\n\n## Writing\n\n- `create_folder` and `restore_file` add without losing or exposing\n  anything.\n- A new file takes its folder's sharing, not its source's: `create_file`\n  and `copy_file` into a shared folder disclose that content to everyone\n  the folder is shared with, so both are approved like any destructive write.\n  Check the destination with `list_permissions` first. `convertTo`\n  imports content as a Google Doc, Sheet, or Slides file.\n- `update_file_content` replaces the whole content; send all of it.\n  `update_file` renames; `move_file` changes the folder and with it who\n  inherits access.\n- `trash_file` is recoverable for 30 days with `restore_file`. There is no\n  permanent delete and no ownership transfer.\n- `share_file` emails no one unless `sendNotificationEmail: true`. Check\n  `list_permissions` before and after changing access, and confirm with the\n  person before sharing with `anyone` or a whole domain.\n",
     "instructionsHeading": "Connection instructions",
     "fragments": {
         "guide_0": "# Google Drive usage\n\nActs as the signed-in person's own Google Drive through Workspace delegation: what they can open, and nothing they cannot.\n\nConnection purpose: ",
-        "guide_1": "\n\n## Whose Drive\n\nEvery call acts as the Workspace address deployment config maps the caller\nto, and reaches exactly the files that person can open, shared drives\nincluded. No argument names an account. A call with none mapped fails\n`auth_required`; only an operator can change the mapping. A missing file\nand one this person cannot see fail alike — Google does not distinguish them.\n\n## Finding files\n\n- `search_files` takes Drive query syntax: `name contains 'x'`,\n  `fullText contains 'x'`, `mimeType = '…'`, `'<folderId>' in parents`,\n  `modifiedTime > '2026-01-01T00:00:00'`. Quote values with single quotes.\n  Trashed files are left out unless `includeTrashed`. `incompleteSearch:\n  true` means Drive gave up before searching everything; narrow the query or\n  the corpus. Shared drives: `list_shared_drives`, then `corpora: \"drive\"`\n  with its `driveId`.\n- Page with `page.nextCursor` and the same arguments; a cursor from another\n  tool or other arguments is refused. A page can stop short of `limit` to\n  stay under `maxBytes`; the cursor resumes at the first row left out, and\n  fails `conflict` if that page changed meanwhile — start over then.\n- Ids come from these reads or a Drive URL (`/d/<id>/`, `/folders/<id>`);\n  never guess one.\n\n## Reading content\n\n- `get_file_content` exports Docs as Markdown, Sheets as CSV of the\n  **first sheet only**, and Slides as plain text; reads text files as text;\n  and returns other files as base64 when the encoded file fits the result. Anything else — a\n  larger binary, a drawing, a form, a folder, a shortcut — comes back as\n  `format: \"unavailable\"` with a `note`, never as an empty success.\n- Text is capped by `maxChars`; a cut ends with a truncation marker and\n  `contentTruncated: true`. Drive exports at most 10 MB.\n- Every read stays under `maxBytes` of JSON. The default is what one result\n  can carry into `execute_code`, so a program always receives it. A larger\n  `maxBytes` (up to 4 MiB — a binary of up to 1 MiB) reaches only a direct\n  `call_tool`, which pages it with `connecta.result`.\n\n## Writing\n\n- `create_folder` and `restore_file` add without losing or exposing\n  anything.\n- A new file takes its folder's sharing, not its source's: `create_file`\n  and `copy_file` into a shared folder disclose that content to everyone\n  the folder is shared with, so both are approved like any destructive write.\n  Check the destination with `list_permissions` first. `convertTo`\n  imports content as a Google Doc, Sheet, or Slides file.\n- `update_file_content` replaces the whole content; send all of it.\n  `update_file` renames; `move_file` changes the folder and with it who\n  inherits access.\n- `trash_file` is recoverable for 30 days with `restore_file`. There is no\n  permanent delete and no ownership transfer.\n- `share_file` emails no one unless `sendNotificationEmail: true`. Check\n  `list_permissions` before and after changing access, and confirm with the\n  person before sharing with `anyone` or a whole domain.\n"
+        "guide_1": "\n\n## Whose Drive\n\nEvery call acts as the Workspace address deployment config maps the caller\nto, and reaches exactly the files that person can open, shared drives\nincluded; an agent acts as the owner of the pool it came through, unless the deployment fixes one shared account that every caller, agent or person, acts as. No\nargument names an account. A call with none mapped fails `auth_required`; only an operator can change\nthat. A missing file\nand one this person cannot see fail alike — Google does not distinguish them.\n\n## Finding files\n\n- `search_files` takes Drive query syntax: `name contains 'x'`,\n  `fullText contains 'x'`, `mimeType = '…'`, `'<folderId>' in parents`,\n  `modifiedTime > '2026-01-01T00:00:00'`. Quote values with single quotes.\n  Trashed files are left out unless `includeTrashed`. `incompleteSearch:\n  true` means Drive gave up before searching everything; narrow the query or\n  the corpus. Shared drives: `list_shared_drives`, then `corpora: \"drive\"`\n  with its `driveId`.\n- Page with `page.nextCursor` and the same arguments; a cursor from another\n  tool or other arguments is refused. A page can stop short of `limit` to\n  stay under `maxBytes`; the cursor resumes at the first row left out, and\n  fails `conflict` if that page changed meanwhile — start over then.\n- Ids come from these reads or a Drive URL (`/d/<id>/`, `/folders/<id>`);\n  never guess one.\n\n## Reading content\n\n- `get_file_content` exports Docs as Markdown, Sheets as CSV of the\n  **first sheet only**, and Slides as plain text; reads text files as text;\n  and returns other files as base64 when the encoded file fits the result. Anything else — a\n  larger binary, a drawing, a form, a folder, a shortcut — comes back as\n  `format: \"unavailable\"` with a `note`, never as an empty success.\n- Text is capped by `maxChars`; a cut ends with a truncation marker and\n  `contentTruncated: true`. Drive exports at most 10 MB.\n- Every read stays under `maxBytes` of JSON. The default is what one result\n  can carry into `execute_code`, so a program always receives it. A larger\n  `maxBytes` (up to 4 MiB — a binary of up to 1 MiB) reaches only a direct\n  `call_tool`, which pages it with `connecta.result`.\n\n## Writing\n\n- `create_folder` and `restore_file` add without losing or exposing\n  anything.\n- A new file takes its folder's sharing, not its source's: `create_file`\n  and `copy_file` into a shared folder disclose that content to everyone\n  the folder is shared with, so both are approved like any destructive write.\n  Check the destination with `list_permissions` first. `convertTo`\n  imports content as a Google Doc, Sheet, or Slides file.\n- `update_file_content` replaces the whole content; send all of it.\n  `update_file` renames; `move_file` changes the folder and with it who\n  inherits access.\n- `trash_file` is recoverable for 30 days with `restore_file`. There is no\n  permanent delete and no ownership transfer.\n- `share_file` emails no one unless `sendNotificationEmail: true`. Check\n  `list_permissions` before and after changing access, and confirm with the\n  person before sharing with `anyone` or a whole domain.\n"
     }
 };

package/dist/providers/forms/index.js

@@ -22,13 +22,13 @@ import { skill } from "./skill.generated.js";
  *
  * Drift. Google publishes a credential-free Discovery document per API.
  * `src/providers/forms/drift.json` records the five methods the tools
- * call, and `npm run providers:check -- --provider forms` reports a touched
+ * call, and `pnpm run providers:check --provider forms` reports a touched
  * contract that moved or a method that stopped accepting the scopes below.
  */
 import { apiConnector as api, defined } from "../../connectors/api-connector.js";
 import { ConnectorCallError } from "../../errors.js";
 import { clampText, jsonBytes, RESULT_BUDGET_BYTES } from "../_shared/google/result-size.js";
-import { googleOutcomeOf, GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, } from "../_shared/google/workspace.js";
+import { googleOutcomeOf, GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, workspaceConnector, } from "../_shared/google/workspace.js";
 import { asProviderFactory } from "../../provider.js";
 /**
  * The Forms API root. Every path the tools send sits beneath `/forms`; there
@@ -1198,7 +1198,7 @@ function formsConnector(id, options) {
         notFound: "ambiguous",
         connection,
     });
-    return api(id, {
+    return workspaceConnector(connection, api(id, {
         ...defined({
             callAdmission: options.callAdmission,
             maxResultBytes: options.maxResultBytes,
@@ -1213,5 +1213,5 @@ function formsConnector(id, options) {
             required: true,
         },
         tools: tools(client),
-    });
+    }));
 }

package/dist/providers/forms/skill.generated.js

@@ -1,10 +1,10 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "# Google Forms usage\n\nActs as the signed-in person in Google Forms through Workspace delegation: read and edit their forms, read responses, never submit or delete.\n\nConnection purpose: \n\n## Whose forms\n\nEvery call reaches only the forms the Workspace user deployment config maps\nthe caller to can open. No argument names a user. A call with none mapped\nfails `auth_required`; only an operator can change the mapping. A form id\nthat does not exist and one not shared with that user fail alike, as\n`connector_call_failed`: Google does not say which.\n\n## Finding forms\n\nThere is no list or search here: the Forms API has none. Find a form in\nDrive, or take its id from an edit URL (`/forms/d/<formId>/edit`). The\n`/forms/d/e/…` responder link is not the form id.\n\n## Reading\n\n- Every result stays inside  KiB, so it crosses into\n  `execute_code` whole. A page that would outgrow that ends early with\n  `page.hasMore`; follow `page.nextCursor` rather than raising `limit`.\n- `get_form` lists items with their `questions`: one for a question,\n  one per row for a grid, none for sections and media. Answers are keyed by\n  those `questionId`s. A large form pages its items (`itemCount` is the\n  total), and a grid too large for one page continues on the next: the item\n  repeats with `questionsFrom`, the index of its first row there, and\n  `moreQuestions` counts rows still to come. A cursor from a form that has\n  since changed fails `conflict`.\n  Long text is cut with a marker; `raw: true` returns Google's whole Form\n  resource, or refuses one too large for a result.\n- `list_responses` labels each answer with its question's title, in form\n  order; an answer to a since-deleted question has no title. Answers longer\n  than  characters end with a truncation marker; `get_response`\n  reads one whole. Page with `page.nextCursor` and the same\n  `submittedAfter`. To read only new responses, pass the newest\n  `lastSubmittedTime` already seen as `submittedAfter`. A cursor\n  continues after the last response it returned; if Google's page has\n  changed since (new, deleted, or reordered responses), it fails\n  `conflict` — start again, or use `submittedAfter`.\n- A response too large for one result comes back cut, with the answers left\n  out named in `omittedQuestionIds`; pass them to `get_response` as\n  `questionIds`.\n\n## Editing\n\n- `create_form` makes an empty form: Google takes only its title and Drive\n  file name at creation. Add a description and questions afterwards.\n- `update_form_info` replaces the title or description.\n- `batch_update_form` is the escape hatch for everything else, and always\n  needs approval. It takes Google's own Request objects, applied all or none,\n  with the form's current `revisionId` as `requiredRevisionId`: a form\n  someone changed since you read it is refused as `conflict`, so re-read it\n  and rebuild the edit. Its reply carries the new `revisionId` and each created item's id.\n  A reply too large to return whole comes back with `truncated: true`: the\n  batch still applied; read the rest with `get_form`. An `updateItem` needs an `updateMask`; read `raw: true` first so the\n  item it replaces keeps its grading, images, and navigation.\n- Publishing, sharing, deleting, and watches are not in this connection; the\n  owner does those in Forms or Drive. Responses are read-only.\n",
+    "content": "# Google Forms usage\n\nActs as the signed-in person in Google Forms through Workspace delegation: read and edit their forms, read responses, never submit or delete.\n\nConnection purpose: \n\n## Whose forms\n\nEvery call reaches only the forms the Workspace user deployment config maps\nthe caller to can open; an agent acts as the owner of the pool it came through, unless the deployment fixes one shared account that every caller, agent or person, acts as. No argument names a user. A call with none mapped fails `auth_required`; only an operator can change\nthat. A form id\nthat does not exist and one not shared with that user fail alike, as\n`connector_call_failed`: Google does not say which.\n\n## Finding forms\n\nThere is no list or search here: the Forms API has none. Find a form in\nDrive, or take its id from an edit URL (`/forms/d/<formId>/edit`). The\n`/forms/d/e/…` responder link is not the form id.\n\n## Reading\n\n- Every result stays inside  KiB, so it crosses into\n  `execute_code` whole. A page that would outgrow that ends early with\n  `page.hasMore`; follow `page.nextCursor` rather than raising `limit`.\n- `get_form` lists items with their `questions`: one for a question,\n  one per row for a grid, none for sections and media. Answers are keyed by\n  those `questionId`s. A large form pages its items (`itemCount` is the\n  total), and a grid too large for one page continues on the next: the item\n  repeats with `questionsFrom`, the index of its first row there, and\n  `moreQuestions` counts rows still to come. A cursor from a form that has\n  since changed fails `conflict`.\n  Long text is cut with a marker; `raw: true` returns Google's whole Form\n  resource, or refuses one too large for a result.\n- `list_responses` labels each answer with its question's title, in form\n  order; an answer to a since-deleted question has no title. Answers longer\n  than  characters end with a truncation marker; `get_response`\n  reads one whole. Page with `page.nextCursor` and the same\n  `submittedAfter`. To read only new responses, pass the newest\n  `lastSubmittedTime` already seen as `submittedAfter`. A cursor\n  continues after the last response it returned; if Google's page has\n  changed since (new, deleted, or reordered responses), it fails\n  `conflict` — start again, or use `submittedAfter`.\n- A response too large for one result comes back cut, with the answers left\n  out named in `omittedQuestionIds`; pass them to `get_response` as\n  `questionIds`.\n\n## Editing\n\n- `create_form` makes an empty form: Google takes only its title and Drive\n  file name at creation. Add a description and questions afterwards.\n- `update_form_info` replaces the title or description.\n- `batch_update_form` is the escape hatch for everything else, and always\n  needs approval. It takes Google's own Request objects, applied all or none,\n  with the form's current `revisionId` as `requiredRevisionId`: a form\n  someone changed since you read it is refused as `conflict`, so re-read it\n  and rebuild the edit. Its reply carries the new `revisionId` and each created item's id.\n  A reply too large to return whole comes back with `truncated: true`: the\n  batch still applied; read the rest with `get_form`. An `updateItem` needs an `updateMask`; read `raw: true` first so the\n  item it replaces keeps its grading, images, and navigation.\n- Publishing, sharing, deleting, and watches are not in this connection; the\n  owner does those in Forms or Drive. Responses are read-only.\n",
     "instructionsHeading": "Connection instructions",
     "fragments": {
         "guide_0": "# Google Forms usage\n\nActs as the signed-in person in Google Forms through Workspace delegation: read and edit their forms, read responses, never submit or delete.\n\nConnection purpose: ",
-        "guide_1": "\n\n## Whose forms\n\nEvery call reaches only the forms the Workspace user deployment config maps\nthe caller to can open. No argument names a user. A call with none mapped\nfails `auth_required`; only an operator can change the mapping. A form id\nthat does not exist and one not shared with that user fail alike, as\n`connector_call_failed`: Google does not say which.\n\n## Finding forms\n\nThere is no list or search here: the Forms API has none. Find a form in\nDrive, or take its id from an edit URL (`/forms/d/<formId>/edit`). The\n`/forms/d/e/…` responder link is not the form id.\n\n## Reading\n\n- Every result stays inside ",
+        "guide_1": "\n\n## Whose forms\n\nEvery call reaches only the forms the Workspace user deployment config maps\nthe caller to can open; an agent acts as the owner of the pool it came through, unless the deployment fixes one shared account that every caller, agent or person, acts as. No argument names a user. A call with none mapped fails `auth_required`; only an operator can change\nthat. A form id\nthat does not exist and one not shared with that user fail alike, as\n`connector_call_failed`: Google does not say which.\n\n## Finding forms\n\nThere is no list or search here: the Forms API has none. Find a form in\nDrive, or take its id from an edit URL (`/forms/d/<formId>/edit`). The\n`/forms/d/e/…` responder link is not the form id.\n\n## Reading\n\n- Every result stays inside ",
         "guide_2": " KiB, so it crosses into\n  `execute_code` whole. A page that would outgrow that ends early with\n  `page.hasMore`; follow `page.nextCursor` rather than raising `limit`.\n- `get_form` lists items with their `questions`: one for a question,\n  one per row for a grid, none for sections and media. Answers are keyed by\n  those `questionId`s. A large form pages its items (`itemCount` is the\n  total), and a grid too large for one page continues on the next: the item\n  repeats with `questionsFrom`, the index of its first row there, and\n  `moreQuestions` counts rows still to come. A cursor from a form that has\n  since changed fails `conflict`.\n  Long text is cut with a marker; `raw: true` returns Google's whole Form\n  resource, or refuses one too large for a result.\n- `list_responses` labels each answer with its question's title, in form\n  order; an answer to a since-deleted question has no title. Answers longer\n  than ",
         "guide_3": " characters end with a truncation marker; `get_response`\n  reads one whole. Page with `page.nextCursor` and the same\n  `submittedAfter`. To read only new responses, pass the newest\n  `lastSubmittedTime` already seen as `submittedAfter`. A cursor\n  continues after the last response it returned; if Google's page has\n  changed since (new, deleted, or reordered responses), it fails\n  `conflict` — start again, or use `submittedAfter`.\n- A response too large for one result comes back cut, with the answers left\n  out named in `omittedQuestionIds`; pass them to `get_response` as\n  `questionIds`.\n\n## Editing\n\n- `create_form` makes an empty form: Google takes only its title and Drive\n  file name at creation. Add a description and questions afterwards.\n- `update_form_info` replaces the title or description.\n- `batch_update_form` is the escape hatch for everything else, and always\n  needs approval. It takes Google's own Request objects, applied all or none,\n  with the form's current `revisionId` as `requiredRevisionId`: a form\n  someone changed since you read it is refused as `conflict`, so re-read it\n  and rebuild the edit. Its reply carries the new `revisionId` and each created item's id.\n  A reply too large to return whole comes back with `truncated: true`: the\n  batch still applied; read the rest with `get_form`. An `updateItem` needs an `updateMask`; read `raw: true` first so the\n  item it replaces keeps its grading, images, and navigation.\n- Publishing, sharing, deleting, and watches are not in this connection; the\n  owner does those in Forms or Drive. Responses are read-only.\n"
     }

package/dist/providers/gmail/index.js

@@ -21,12 +21,12 @@ import { skill } from "./skill.generated.js";
  *
  * Drift. Google publishes a credential-free Discovery document per API.
  * `src/providers/gmail/drift.json` records the nine methods the tools
- * call, and `npm run providers:check -- --provider gmail` reports a touched
+ * call, and `pnpm run providers:check --provider gmail` reports a touched
  * contract that moved or a method that stopped accepting the scopes below.
  */
 import { apiConnector as api, defined } from "../../connectors/api-connector.js";
 import { ConnectorCallError } from "../../errors.js";
-import { GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, } from "../_shared/google/workspace.js";
+import { GOOGLE_WORKSPACE_OPTIONS, googleWorkspaceClient, workspaceConnection, workspaceConnector, } from "../_shared/google/workspace.js";
 import { RESULT_BUDGET_BYTES, clampText, jsonBytes } from "../_shared/google/result-size.js";
 import { asProviderFactory } from "../../provider.js";
 /**
@@ -204,10 +204,6 @@ function walk(root, enterAttachmentRoot = false) {
 function ownBody(own) {
     return own.find((part) => mimeOf(part) === "text/plain") ?? own.find((part) => mimeOf(part) === "text/html");
 }
-function bodyText(part, decoded) {
-    const body = mimeOf(part) === "text/html" ? htmlToText(decoded.text) : decoded.text;
-    return decoded.note ? `${body}\n[${decoded.note}]` : body;
-}
 /** Gmail stores a large body apart from the message, behind an attachment id. */
 const MAX_STORED_BODY_BYTES = 1024 * 1024;
 /**
@@ -245,7 +241,11 @@ async function readBody(client, ctx, messageId, payload, max) {
     }
     const decoded = data ? decodeIn(chosen, data) : { text: "" };
     // Uncut: the caller caps it, by characters and by the result's bytes.
-    return { text: bodyText(chosen, decoded), bodyFormat: format };
+    return {
+        text: format === "html" ? htmlToText(decoded.text) : decoded.text,
+        bodyFormat: format,
+        ...(decoded.note ? { bodyNote: decoded.note } : {}),
+    };
 }
 /**
  * Gmail's ids are short opaque tokens — message and thread ids are sixteen
@@ -530,6 +530,7 @@ async function projectMessage(client, ctx, value, maxBodyChars, budget = RESULT_
         body: "",
         bodyTruncated: false,
         bodyFormat: read.bodyFormat,
+        bodyNote: read.bodyNote,
         attachments: attachments.listed.length > 0 ? attachments.listed : undefined,
         attachmentsOmitted: attachments.omitted > 0 ? attachments.omitted : undefined,
         omittedIds,
@@ -1089,6 +1090,7 @@ const MESSAGE_PROPERTIES = {
     body: { type: "string" },
     bodyTruncated: { type: "boolean" },
     bodyFormat: { type: "string", enum: ["text", "html", "none", "unavailable"] },
+    bodyNote: { type: "string", description: "Decoding notice, preserved when the body is truncated." },
     attachments: { type: "array", items: ATTACHMENT_SCHEMA },
     attachmentsOmitted: { type: "integer" },
 };
@@ -1662,7 +1664,7 @@ function gmailConnector(id, options) {
         notFound: "absent",
         connection,
     });
-    return api(id, {
+    return workspaceConnector(connection, api(id, {
         ...defined({
             callAdmission: options.callAdmission,
             maxResultBytes: options.maxResultBytes,
@@ -1683,5 +1685,5 @@ function gmailConnector(id, options) {
                 ? args["maxBytes"]
                 : RESULT_BUDGET_BYTES),
         })),
-    });
+    }));
 }

package/dist/providers/gmail/skill.generated.js

@@ -1,9 +1,9 @@
 // Generated by scripts/generate-providers.mjs; do not edit.
 export const skill = {
-    "content": "# Gmail usage (draft-only)\n\nActs as the signed-in person's own Gmail through Workspace delegation: read mail and write drafts, never send.\n\nConnection purpose: \n\n## Whose mailbox\n\nEvery call reads and writes the mailbox deployment config maps the caller\nto. No argument names a mailbox. A call with none mapped fails\n`auth_required`; only an operator can change the mapping.\n\n## Reading\n\n- `search_threads` takes Gmail search syntax; reuse the person's own\n  phrasing (`from:`, `subject:`, `newer_than:7d`, `is:unread`,\n  `label:`). Page with `page.nextCursor` and the same query.\n- `get_thread` returns messages oldest first with bodies capped by\n  `maxBodyChars`; a cut body ends with a truncation marker. A long thread\n  pages: follow `page.nextCursor` until `hasMore` is false, with the same\n  arguments. `conflict` means the thread changed under the cursor; read it\n  again from the start. Reduce inside\n  `execute_code` before returning a long thread.\n- Results default to at most 192 KiB; `list_labels` pages the same way.\n- `get_message` and `get_thread` list attachment metadata. An attached or\n  forwarded email is an attachment, not the body.\n- `bodyFormat: \"unavailable\"` means Gmail stored the body apart from the\n  message and it is too large to read here; say so rather than summarizing.\n\n## Attachments\n\n- `get_attachment` takes `messageId` and the listing's immutable `partId`.\n  Prefer `partId`, which stays stable across message reads, including an\n  empty id for a root attachment. `attachmentId` is an alternative that\n  Gmail can rotate between reads. When both are supplied, `partId` wins and\n  the fresh message's download id is used. Read the listing again after\n  an unknown-id refusal; never store an attachmentId for later use.\n- Small attachments can have inline data and no attachmentId. Use their\n  partId too. Only carried attachment parts can be read, never arbitrary\n  message body parts or blind download ids.\n- Text, JSON, XML, calendar invites, CSV, and `message/rfc822` return\n  `format: \"text\"` and `content` decoded in the declared charset. An unsupported\n  charset produces an explicit note that decoding used UTF-8. Message bodies\n  include the same notice in their text.\n  Parsed forwarded emails render From, To, Date, Subject, and their own\n  plain body, else HTML converted to text. Raw forwarded data is preferred\n  when present. A forwarded email without readable text returns an\n  `unavailable` note.\n  `maxChars` defaults to 12,000 code points, at most 100,000. A character\n  or byte cut ends with a truncation marker and `contentTruncated: true`.\n  Reduce attachment text inside `execute_code` before returning it.\n- Binary attachments return `format: \"base64\"` and standard base64 in\n  `content`. Pass it unchanged to Drive `create_file` as `contentBase64`,\n  with `name: filename` and `mimeType`. File creation is a write: use\n  `call_destructive_tool` or a program on a writable endpoint for that step.\n- Downloads, text and binary, are limited to 1 MiB. Declared size is\n  checked before a separate download. Parsed forwarded emails check the sum\n  of descendant sizes before downloading any stored body, and return that\n  sum as `size`. Attachment data must match both the message part's declared\n  size and the download response's size when supplied; inconsistent payloads\n  fail rather than return incomplete files. Binary content must also fit the\n  whole-result `maxBytes`, which defaults to 192 KiB. `format: \"unavailable\"`\n  returns a note and no content when it cannot fit. Raising `maxChars`\n  or `maxBytes` cannot bypass the download cap.\n- Raise `maxBytes` only for a direct `call_tool` read, from 64 KiB up to\n  4 MiB, as with Drive `get_file_content`. `execute_code` cannot receive\n  large results; keep the default there. Direct-call results may be paged.\n\n## Drafting\n\n- `create_draft` saves a draft and never sends it; tell the person it is\n  waiting in Drafts. There is no send, delete, or label tool.\n- To reply, pass `replyToMessageId`: the draft joins that thread with\n  In-Reply-To and References set, and subject (Re: …) and `to` default\n  from that message's Reply-To, else its From. Keep the Re: subject or Gmail\n  may start a new thread.\n- `update_draft` replaces the body entirely; send the full new text.\n  From, To, Cc, Bcc, Reply-To, Subject, the thread, and reply headers are\n  kept unless restated; no other header is. A draft with attachments or\n  inline images is refused, unchanged — Gmail's update would delete them.\n- Gmail sets From to the mailbox itself; there is no From argument.\n",
+    "content": "# Gmail usage (draft-only)\n\nActs as the signed-in person's own Gmail through Workspace delegation: read mail and write drafts, never send.\n\nConnection purpose: \n\n## Whose mailbox\n\nEvery call reads and writes the mailbox deployment config maps the caller\nto; an agent acts as the owner of the pool it came through, unless the deployment fixes one shared mailbox that every caller, agent or person, acts as. No argument\nnames a mailbox. A call with none mapped fails `auth_required`; only an operator can change\nthat.\n\n## Reading\n\n- `search_threads` takes Gmail search syntax; reuse the person's own\n  phrasing (`from:`, `subject:`, `newer_than:7d`, `is:unread`,\n  `label:`). Page with `page.nextCursor` and the same query.\n- `get_thread` returns messages oldest first with bodies capped by\n  `maxBodyChars`; a cut body ends with a truncation marker. A long thread\n  pages: follow `page.nextCursor` until `hasMore` is false, with the same\n  arguments. `conflict` means the thread changed under the cursor; read it\n  again from the start. Reduce inside\n  `execute_code` before returning a long thread.\n- Results default to at most 192 KiB; `list_labels` pages the same way.\n- `get_message` and `get_thread` list attachment metadata. An attached or\n  forwarded email is an attachment, not the body.\n- `bodyFormat: \"unavailable\"` means Gmail stored the body apart from the\n  message and it is too large to read here; say so rather than summarizing.\n- `get_message`, each `get_thread` message, and `get_draft` return `bodyNote`\n  when decoding falls back to UTF-8 for an unsupported charset. The note\n  survives character and result-byte truncation, including `maxBodyChars: 0`\n  when inline body data is decoded. It counts toward the result's byte limit.\n\n## Attachments\n\n- `get_attachment` takes `messageId` and the listing's immutable `partId`.\n  Prefer `partId`, which stays stable across message reads, including an\n  empty id for a root attachment. `attachmentId` is an alternative that\n  Gmail can rotate between reads. When both are supplied, `partId` wins and\n  the fresh message's download id is used. Read the listing again after\n  an unknown-id refusal; never store an attachmentId for later use.\n- Small attachments can have inline data and no attachmentId. Use their\n  partId too. Only carried attachment parts can be read, never arbitrary\n  message body parts or blind download ids.\n- Text, JSON, XML, calendar invites, CSV, and `message/rfc822` return\n  `format: \"text\"` and `content` decoded in the declared charset. An unsupported\n  charset produces an explicit `note` that decoding used UTF-8. Message bodies\n  return the notice separately as `bodyNote`.\n  Parsed forwarded emails render From, To, Date, Subject, and their own\n  plain body, else HTML converted to text. Raw forwarded data is preferred\n  when present. A forwarded email without readable text returns an\n  `unavailable` note.\n  `maxChars` defaults to 12,000 code points, at most 100,000. A character\n  or byte cut ends with a truncation marker and `contentTruncated: true`.\n  Reduce attachment text inside `execute_code` before returning it.\n- Binary attachments return `format: \"base64\"` and standard base64 in\n  `content`. Pass it unchanged to Drive `create_file` as `contentBase64`,\n  with `name: filename` and `mimeType`. File creation is a write: use\n  `call_destructive_tool` or a program on a writable endpoint for that step.\n- Downloads, text and binary, are limited to 1 MiB. Declared size is\n  checked before a separate download. Parsed forwarded emails check the sum\n  of descendant sizes before downloading any stored body, and return that\n  sum as `size`. Attachment data must match both the message part's declared\n  size and the download response's size when supplied; inconsistent payloads\n  fail rather than return incomplete files. Binary content must also fit the\n  whole-result `maxBytes`, which defaults to 192 KiB. `format: \"unavailable\"`\n  returns a note and no content when it cannot fit. Raising `maxChars`\n  or `maxBytes` cannot bypass the download cap.\n- Raise `maxBytes` only for a direct `call_tool` read, from 64 KiB up to\n  4 MiB, as with Drive `get_file_content`. `execute_code` cannot receive\n  large results; keep the default there. Direct-call results may be paged.\n\n## Drafting\n\n- `create_draft` saves a draft and never sends it; tell the person it is\n  waiting in Drafts. There is no send, delete, or label tool.\n- To reply, pass `replyToMessageId`: the draft joins that thread with\n  In-Reply-To and References set, and subject (Re: …) and `to` default\n  from that message's Reply-To, else its From. Keep the Re: subject or Gmail\n  may start a new thread.\n- `update_draft` replaces the body entirely; send the full new text.\n  From, To, Cc, Bcc, Reply-To, Subject, the thread, and reply headers are\n  kept unless restated; no other header is. A draft with attachments or\n  inline images is refused, unchanged — Gmail's update would delete them.\n- Gmail sets From to the mailbox itself; there is no From argument.\n",
     "instructionsHeading": "Connection instructions",
     "fragments": {
         "guide_0": "# Gmail usage (draft-only)\n\nActs as the signed-in person's own Gmail through Workspace delegation: read mail and write drafts, never send.\n\nConnection purpose: ",
-        "guide_1": "\n\n## Whose mailbox\n\nEvery call reads and writes the mailbox deployment config maps the caller\nto. No argument names a mailbox. A call with none mapped fails\n`auth_required`; only an operator can change the mapping.\n\n## Reading\n\n- `search_threads` takes Gmail search syntax; reuse the person's own\n  phrasing (`from:`, `subject:`, `newer_than:7d`, `is:unread`,\n  `label:`). Page with `page.nextCursor` and the same query.\n- `get_thread` returns messages oldest first with bodies capped by\n  `maxBodyChars`; a cut body ends with a truncation marker. A long thread\n  pages: follow `page.nextCursor` until `hasMore` is false, with the same\n  arguments. `conflict` means the thread changed under the cursor; read it\n  again from the start. Reduce inside\n  `execute_code` before returning a long thread.\n- Results default to at most 192 KiB; `list_labels` pages the same way.\n- `get_message` and `get_thread` list attachment metadata. An attached or\n  forwarded email is an attachment, not the body.\n- `bodyFormat: \"unavailable\"` means Gmail stored the body apart from the\n  message and it is too large to read here; say so rather than summarizing.\n\n## Attachments\n\n- `get_attachment` takes `messageId` and the listing's immutable `partId`.\n  Prefer `partId`, which stays stable across message reads, including an\n  empty id for a root attachment. `attachmentId` is an alternative that\n  Gmail can rotate between reads. When both are supplied, `partId` wins and\n  the fresh message's download id is used. Read the listing again after\n  an unknown-id refusal; never store an attachmentId for later use.\n- Small attachments can have inline data and no attachmentId. Use their\n  partId too. Only carried attachment parts can be read, never arbitrary\n  message body parts or blind download ids.\n- Text, JSON, XML, calendar invites, CSV, and `message/rfc822` return\n  `format: \"text\"` and `content` decoded in the declared charset. An unsupported\n  charset produces an explicit note that decoding used UTF-8. Message bodies\n  include the same notice in their text.\n  Parsed forwarded emails render From, To, Date, Subject, and their own\n  plain body, else HTML converted to text. Raw forwarded data is preferred\n  when present. A forwarded email without readable text returns an\n  `unavailable` note.\n  `maxChars` defaults to 12,000 code points, at most 100,000. A character\n  or byte cut ends with a truncation marker and `contentTruncated: true`.\n  Reduce attachment text inside `execute_code` before returning it.\n- Binary attachments return `format: \"base64\"` and standard base64 in\n  `content`. Pass it unchanged to Drive `create_file` as `contentBase64`,\n  with `name: filename` and `mimeType`. File creation is a write: use\n  `call_destructive_tool` or a program on a writable endpoint for that step.\n- Downloads, text and binary, are limited to 1 MiB. Declared size is\n  checked before a separate download. Parsed forwarded emails check the sum\n  of descendant sizes before downloading any stored body, and return that\n  sum as `size`. Attachment data must match both the message part's declared\n  size and the download response's size when supplied; inconsistent payloads\n  fail rather than return incomplete files. Binary content must also fit the\n  whole-result `maxBytes`, which defaults to 192 KiB. `format: \"unavailable\"`\n  returns a note and no content when it cannot fit. Raising `maxChars`\n  or `maxBytes` cannot bypass the download cap.\n- Raise `maxBytes` only for a direct `call_tool` read, from 64 KiB up to\n  4 MiB, as with Drive `get_file_content`. `execute_code` cannot receive\n  large results; keep the default there. Direct-call results may be paged.\n\n## Drafting\n\n- `create_draft` saves a draft and never sends it; tell the person it is\n  waiting in Drafts. There is no send, delete, or label tool.\n- To reply, pass `replyToMessageId`: the draft joins that thread with\n  In-Reply-To and References set, and subject (Re: …) and `to` default\n  from that message's Reply-To, else its From. Keep the Re: subject or Gmail\n  may start a new thread.\n- `update_draft` replaces the body entirely; send the full new text.\n  From, To, Cc, Bcc, Reply-To, Subject, the thread, and reply headers are\n  kept unless restated; no other header is. A draft with attachments or\n  inline images is refused, unchanged — Gmail's update would delete them.\n- Gmail sets From to the mailbox itself; there is no From argument.\n"
+        "guide_1": "\n\n## Whose mailbox\n\nEvery call reads and writes the mailbox deployment config maps the caller\nto; an agent acts as the owner of the pool it came through, unless the deployment fixes one shared mailbox that every caller, agent or person, acts as. No argument\nnames a mailbox. A call with none mapped fails `auth_required`; only an operator can change\nthat.\n\n## Reading\n\n- `search_threads` takes Gmail search syntax; reuse the person's own\n  phrasing (`from:`, `subject:`, `newer_than:7d`, `is:unread`,\n  `label:`). Page with `page.nextCursor` and the same query.\n- `get_thread` returns messages oldest first with bodies capped by\n  `maxBodyChars`; a cut body ends with a truncation marker. A long thread\n  pages: follow `page.nextCursor` until `hasMore` is false, with the same\n  arguments. `conflict` means the thread changed under the cursor; read it\n  again from the start. Reduce inside\n  `execute_code` before returning a long thread.\n- Results default to at most 192 KiB; `list_labels` pages the same way.\n- `get_message` and `get_thread` list attachment metadata. An attached or\n  forwarded email is an attachment, not the body.\n- `bodyFormat: \"unavailable\"` means Gmail stored the body apart from the\n  message and it is too large to read here; say so rather than summarizing.\n- `get_message`, each `get_thread` message, and `get_draft` return `bodyNote`\n  when decoding falls back to UTF-8 for an unsupported charset. The note\n  survives character and result-byte truncation, including `maxBodyChars: 0`\n  when inline body data is decoded. It counts toward the result's byte limit.\n\n## Attachments\n\n- `get_attachment` takes `messageId` and the listing's immutable `partId`.\n  Prefer `partId`, which stays stable across message reads, including an\n  empty id for a root attachment. `attachmentId` is an alternative that\n  Gmail can rotate between reads. When both are supplied, `partId` wins and\n  the fresh message's download id is used. Read the listing again after\n  an unknown-id refusal; never store an attachmentId for later use.\n- Small attachments can have inline data and no attachmentId. Use their\n  partId too. Only carried attachment parts can be read, never arbitrary\n  message body parts or blind download ids.\n- Text, JSON, XML, calendar invites, CSV, and `message/rfc822` return\n  `format: \"text\"` and `content` decoded in the declared charset. An unsupported\n  charset produces an explicit `note` that decoding used UTF-8. Message bodies\n  return the notice separately as `bodyNote`.\n  Parsed forwarded emails render From, To, Date, Subject, and their own\n  plain body, else HTML converted to text. Raw forwarded data is preferred\n  when present. A forwarded email without readable text returns an\n  `unavailable` note.\n  `maxChars` defaults to 12,000 code points, at most 100,000. A character\n  or byte cut ends with a truncation marker and `contentTruncated: true`.\n  Reduce attachment text inside `execute_code` before returning it.\n- Binary attachments return `format: \"base64\"` and standard base64 in\n  `content`. Pass it unchanged to Drive `create_file` as `contentBase64`,\n  with `name: filename` and `mimeType`. File creation is a write: use\n  `call_destructive_tool` or a program on a writable endpoint for that step.\n- Downloads, text and binary, are limited to 1 MiB. Declared size is\n  checked before a separate download. Parsed forwarded emails check the sum\n  of descendant sizes before downloading any stored body, and return that\n  sum as `size`. Attachment data must match both the message part's declared\n  size and the download response's size when supplied; inconsistent payloads\n  fail rather than return incomplete files. Binary content must also fit the\n  whole-result `maxBytes`, which defaults to 192 KiB. `format: \"unavailable\"`\n  returns a note and no content when it cannot fit. Raising `maxChars`\n  or `maxBytes` cannot bypass the download cap.\n- Raise `maxBytes` only for a direct `call_tool` read, from 64 KiB up to\n  4 MiB, as with Drive `get_file_content`. `execute_code` cannot receive\n  large results; keep the default there. Direct-call results may be paged.\n\n## Drafting\n\n- `create_draft` saves a draft and never sends it; tell the person it is\n  waiting in Drafts. There is no send, delete, or label tool.\n- To reply, pass `replyToMessageId`: the draft joins that thread with\n  In-Reply-To and References set, and subject (Re: …) and `to` default\n  from that message's Reply-To, else its From. Keep the Re: subject or Gmail\n  may start a new thread.\n- `update_draft` replaces the body entirely; send the full new text.\n  From, To, Cc, Bcc, Reply-To, Subject, the thread, and reply headers are\n  kept unless restated; no other header is. A draft with attachments or\n  inline images is refused, unchanged — Gmail's update would delete them.\n- Gmail sets From to the mailbox itself; there is no From argument.\n"
     }
 };

package/dist/providers/mixpanel/index.js

@@ -455,7 +455,7 @@ function mixpanelApi(id, options, provider) {
             placeholder: "username:secret",
         },
         testCredential: rest.testCredential,
-        callAdmission: options.callAdmission ?? MIXPANEL_API_ADMISSION,
+        callAdmission: options.callAdmission === undefined ? MIXPANEL_API_ADMISSION : options.callAdmission,
         usageGuide: {
             content: `# Mixpanel API usage\n\nService-account REST, ${region} residency. Account purpose: ${options.purpose}\n\nDefault project: ${options.defaultProjectId ?? "none; supply project_id"}.${skill.fragments.api}${instructions ? `\n## ${skill.instructionsHeading}\n\n${instructions}\n` : ""}`,
             summary: `${REGION_COPY[region]} residency, service-account REST. Raw export, user activity, profiles, reports and event import.`,