granola-toolkit 0.46.2 → 0.48.0

package/dist/cli.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import { Input, ProcessTerminal, TUI, matchesKey, truncateToWidth, visibleWidth, wrapTextWithAnsi } from "@mariozechner/pi-tui";
 import { createHash, randomUUID } from "node:crypto";
-import { appendFile, mkdir, readFile, rm, stat, unlink, writeFile } from "node:fs/promises";
+import { appendFile, mkdir, mkdtemp, readFile, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 import { existsSync } from "node:fs";
-import { homedir, platform } from "node:os";
+import { homedir, platform, tmpdir } from "node:os";
 import { NodeHtmlMarkdown } from "node-html-markdown";
 import { execFile, spawn } from "node:child_process";
 import { promisify } from "node:util";
@@ -118,7 +118,7 @@ function mergeHeaders(...values) {
 	}
 	return headers;
 }
-async function responseError(response) {
+async function responseError$1(response) {
 	let message = `${response.status} ${response.statusText}`.trim();
 	try {
 		const payload = await response.json();
@@ -159,14 +159,14 @@ var GranolaServerClient = class GranolaServerClient {
 			...options.password?.trim() ? { "x-granola-password": options.password.trim() } : {},
 			accept: "application/json"
 		}) });
-		if (!infoResponse.ok) throw await responseError(infoResponse);
+		if (!infoResponse.ok) throw await responseError$1(infoResponse);
 		const info = await infoResponse.json();
 		if (info.protocolVersion !== 2) throw new Error(`unsupported Granola transport protocol: expected 2, got ${info.protocolVersion}`);
 		const response = await fetchImpl(new URL(granolaTransportPaths.state, url), { headers: mergeHeaders({
 			...options.password?.trim() ? { "x-granola-password": options.password.trim() } : {},
 			accept: "application/json"
 		}) });
-		if (!response.ok) throw await responseError(response);
+		if (!response.ok) throw await responseError$1(response);
 		const client = new GranolaServerClient(info, url, await response.json(), options);
 		client.startEvents();
 		return client;
@@ -294,7 +294,7 @@ var GranolaServerClient = class GranolaServerClient {
 				accept: "application/json"
 			}, init.headers)
 		});
-		if (!response.ok) throw await responseError(response);
+		if (!response.ok) throw await responseError$1(response);
 		return response;
 	}
 	async requestJson(path, init = {}) {
@@ -449,7 +449,7 @@ function asRecord(value) {
 function stringValue(value) {
 	return typeof value === "string" ? value : "";
 }
-function stringArray$1(value) {
+function stringArray$2(value) {
 	if (!Array.isArray(value)) return [];
 	return value.filter((item) => typeof item === "string");
 }
@@ -2604,127 +2604,6 @@ const attachCommand = {
 	}
 };
 //#endregion
-//#region src/automation-actions.ts
-function cloneAction$1(action) {
-	switch (action.kind) {
-		case "ask-user": return { ...action };
-		case "command": return {
-			...action,
-			args: action.args ? [...action.args] : void 0,
-			env: action.env ? { ...action.env } : void 0
-		};
-		case "export-notes":
-		case "export-transcript": return { ...action };
-	}
-}
-function automationActionName(action) {
-	return action.name || action.id;
-}
-function buildAutomationActionRunId(match, actionId) {
-	return `${match.id}:${actionId}`;
-}
-function enabledAutomationActions(rule) {
-	return (rule.actions ?? []).filter((action) => action.enabled !== false).map((action) => cloneAction$1(action));
-}
-function baseRun(match, rule, action, startedAt) {
-	return {
-		actionId: action.id,
-		actionKind: action.kind,
-		actionName: automationActionName(action),
-		eventId: match.eventId,
-		eventKind: match.eventKind,
-		folders: match.folders.map((folder) => ({ ...folder })),
-		id: buildAutomationActionRunId(match, action.id),
-		matchedAt: match.matchedAt,
-		meetingId: match.meetingId,
-		ruleId: rule.id,
-		ruleName: rule.name,
-		startedAt,
-		status: "completed",
-		tags: [...match.tags],
-		title: match.title,
-		transcriptLoaded: match.transcriptLoaded
-	};
-}
-function completedRun(run, finishedAt, patch = {}) {
-	return {
-		...run,
-		...patch,
-		finishedAt,
-		status: "completed"
-	};
-}
-function failedRun(run, finishedAt, error) {
-	return {
-		...run,
-		error: error instanceof Error ? error.message : String(error),
-		finishedAt,
-		status: "failed"
-	};
-}
-function skippedRun(run, finishedAt, reason) {
-	return {
-		...run,
-		finishedAt,
-		result: reason,
-		status: "skipped"
-	};
-}
-async function executeAutomationAction(match, rule, action, handlers) {
-	const run = baseRun(match, rule, action, handlers.nowIso());
-	switch (action.kind) {
-		case "ask-user": return {
-			...run,
-			meta: action.details ? { details: action.details } : void 0,
-			prompt: action.prompt,
-			result: "Pending user decision",
-			status: "pending"
-		};
-		case "command": try {
-			const result = await handlers.runCommand(match, rule, action);
-			return completedRun(run, handlers.nowIso(), {
-				meta: {
-					command: result.command,
-					cwd: result.cwd
-				},
-				result: result.output
-			});
-		} catch (error) {
-			return failedRun(run, handlers.nowIso(), error);
-		}
-		case "export-notes": try {
-			const result = await handlers.exportNotes(match, action);
-			if (!result) return skippedRun(run, handlers.nowIso(), "Meeting notes were unavailable for export");
-			return completedRun(run, handlers.nowIso(), {
-				meta: {
-					format: result.format,
-					outputDir: result.outputDir,
-					scope: result.scope,
-					written: result.written
-				},
-				result: `Exported notes to ${result.outputDir}`
-			});
-		} catch (error) {
-			return failedRun(run, handlers.nowIso(), error);
-		}
-		case "export-transcript": try {
-			const result = await handlers.exportTranscripts(match, action);
-			if (!result) return skippedRun(run, handlers.nowIso(), "Transcript data was unavailable for export");
-			return completedRun(run, handlers.nowIso(), {
-				meta: {
-					format: result.format,
-					outputDir: result.outputDir,
-					scope: result.scope,
-					written: result.written
-				},
-				result: `Exported transcript to ${result.outputDir}`
-			});
-		} catch (error) {
-			return failedRun(run, handlers.nowIso(), error);
-		}
-	}
-}
-//#endregion
 //#region src/persistence/layout.ts
 function defaultGranolaToolkitDataDirectory(targetPlatform = platform(), homeDirectory = homedir()) {
 	return targetPlatform === "darwin" ? join(homeDirectory, "Library", "Application Support", "granola-toolkit") : join(homeDirectory, ".config", "granola-toolkit");
@@ -2733,6 +2612,7 @@ function defaultGranolaToolkitPersistenceLayout(options = {}) {
 	const targetPlatform = options.platform ?? platform();
 	const dataDirectory = defaultGranolaToolkitDataDirectory(targetPlatform, options.homeDirectory ?? homedir());
 	return {
+		agentHarnessesFile: join(dataDirectory, "agent-harnesses.json"),
 		automationMatchesFile: join(dataDirectory, "automation-matches.jsonl"),
 		automationRulesFile: join(dataDirectory, "automation-rules.json"),
 		automationRunsFile: join(dataDirectory, "automation-runs.jsonl"),
@@ -2748,110 +2628,757 @@ function defaultGranolaToolkitPersistenceLayout(options = {}) {
 	};
 }
 //#endregion
-//#region src/automation-matches.ts
-function cloneMatch(match) {
+//#region src/agent-harnesses.ts
+function stringArray$1(value) {
+	if (!Array.isArray(value)) return;
+	const values = value.filter((item) => typeof item === "string" && item.trim().length > 0).map((item) => item.trim());
+	return values.length > 0 ? [...new Set(values)] : void 0;
+}
+function parseMatch(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const record = value;
 	return {
-		...match,
-		folders: match.folders.map((folder) => ({ ...folder })),
-		tags: [...match.tags]
+		calendarEventIds: stringArray$1(record.calendarEventIds),
+		eventKinds: stringArray$1(record.eventKinds),
+		folderIds: stringArray$1(record.folderIds),
+		folderNames: stringArray$1(record.folderNames),
+		meetingIds: stringArray$1(record.meetingIds),
+		recurringEventIds: stringArray$1(record.recurringEventIds),
+		tags: stringArray$1(record.tags),
+		titleIncludes: stringArray$1(record.titleIncludes),
+		titleMatches: typeof record.titleMatches === "string" && record.titleMatches.trim() ? record.titleMatches.trim() : void 0,
+		transcriptLoaded: typeof record.transcriptLoaded === "boolean" ? record.transcriptLoaded : void 0
 	};
 }
-var FileAutomationMatchStore = class {
-	constructor(filePath = defaultAutomationMatchesFilePath()) {
-		this.filePath = filePath;
+function parseHarness(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const record = value;
+	const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : void 0;
+	const name = typeof record.name === "string" && record.name.trim() ? record.name.trim() : void 0;
+	if (!id || !name) return;
+	const provider = record.provider === "codex" || record.provider === "openai" || record.provider === "openrouter" ? record.provider : void 0;
+	const prompt = typeof record.prompt === "string" && record.prompt.trim() ? record.prompt.trim() : void 0;
+	const promptFile = typeof record.promptFile === "string" && record.promptFile.trim() ? record.promptFile.trim() : void 0;
+	if (!prompt && !promptFile) return;
+	return {
+		cwd: typeof record.cwd === "string" && record.cwd.trim() ? record.cwd.trim() : void 0,
+		id,
+		match: parseMatch(record.match),
+		model: typeof record.model === "string" && record.model.trim() ? record.model.trim() : void 0,
+		name,
+		priority: typeof record.priority === "number" && Number.isFinite(record.priority) ? record.priority : typeof record.priority === "string" && /^-?\d+$/.test(record.priority) ? Number(record.priority) : void 0,
+		prompt,
+		promptFile,
+		provider,
+		systemPrompt: typeof record.systemPrompt === "string" && record.systemPrompt.trim() ? record.systemPrompt.trim() : void 0,
+		systemPromptFile: typeof record.systemPromptFile === "string" && record.systemPromptFile.trim() ? record.systemPromptFile.trim() : void 0
+	};
+}
+function cloneHarness(harness) {
+	return {
+		...harness,
+		match: harness.match ? {
+			...harness.match,
+			calendarEventIds: harness.match.calendarEventIds ? [...harness.match.calendarEventIds] : void 0,
+			eventKinds: harness.match.eventKinds ? [...harness.match.eventKinds] : void 0,
+			folderIds: harness.match.folderIds ? [...harness.match.folderIds] : void 0,
+			folderNames: harness.match.folderNames ? [...harness.match.folderNames] : void 0,
+			meetingIds: harness.match.meetingIds ? [...harness.match.meetingIds] : void 0,
+			recurringEventIds: harness.match.recurringEventIds ? [...harness.match.recurringEventIds] : void 0,
+			tags: harness.match.tags ? [...harness.match.tags] : void 0,
+			titleIncludes: harness.match.titleIncludes ? [...harness.match.titleIncludes] : void 0
+		} : void 0
+	};
+}
+function includesIgnoreCase$1(candidate, values) {
+	const lowerCandidate = candidate.toLowerCase();
+	return values.some((value) => lowerCandidate.includes(value.toLowerCase()));
+}
+function harnessSpecificity(match) {
+	if (!match) return 0;
+	return [
+		match.calendarEventIds?.length ?? 0,
+		match.eventKinds?.length ?? 0,
+		match.folderIds?.length ?? 0,
+		match.folderNames?.length ?? 0,
+		match.meetingIds?.length ?? 0,
+		match.recurringEventIds?.length ?? 0,
+		match.tags?.length ?? 0,
+		match.titleIncludes?.length ?? 0,
+		match.titleMatches ? 1 : 0,
+		match.transcriptLoaded != null ? 1 : 0
+	].reduce((total, count) => total + count, 0);
+}
+function matchesHarness(harness, context) {
+	const match = harness.match;
+	if (!match) return true;
+	if (match.eventKinds?.length && !match.eventKinds.includes(context.match.eventKind)) return false;
+	if (match.meetingIds?.length && !match.meetingIds.includes(context.match.meetingId)) return false;
+	if (match.folderIds?.length && !context.match.folders.some((folder) => match.folderIds?.includes(folder.id))) return false;
+	if (match.folderNames?.length && !context.match.folders.some((folder) => match.folderNames?.includes(folder.name))) return false;
+	if (match.tags?.length && !context.match.tags.some((tag) => match.tags?.includes(tag))) return false;
+	if (match.transcriptLoaded != null && context.match.transcriptLoaded !== match.transcriptLoaded) return false;
+	if (match.titleIncludes?.length && !includesIgnoreCase$1(context.match.title, match.titleIncludes)) return false;
+	if (match.titleMatches) try {
+		if (!new RegExp(match.titleMatches, "i").test(context.match.title)) return false;
+	} catch {
+		return false;
 	}
-	async appendMatches(matches) {
-		if (matches.length === 0) return;
-		await mkdir(dirname(this.filePath), { recursive: true });
-		const payload = matches.map((match) => JSON.stringify(match)).join("\n");
-		await appendFile(this.filePath, `${payload}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
+	const calendarEventId = context.bundle?.document.calendarEvent?.id;
+	if (match.calendarEventIds?.length && !calendarEventId) return false;
+	if (match.calendarEventIds?.length && !match.calendarEventIds.includes(calendarEventId)) return false;
+	const recurringEventId = context.bundle?.document.calendarEvent?.recurringEventId;
+	if (match.recurringEventIds?.length && !recurringEventId) return false;
+	if (match.recurringEventIds?.length && !match.recurringEventIds.includes(recurringEventId)) return false;
+	return true;
+}
+function matchAgentHarnesses(harnesses, context) {
+	return harnesses.filter((harness) => matchesHarness(harness, context)).slice().sort((left, right) => {
+		const priority = (right.priority ?? 0) - (left.priority ?? 0);
+		if (priority !== 0) return priority;
+		return harnessSpecificity(right.match) - harnessSpecificity(left.match);
+	}).map(cloneHarness);
+}
+function resolveAgentHarness(harnesses, context, harnessId) {
+	if (harnessId?.trim()) {
+		const harness = harnesses.find((candidate) => candidate.id === harnessId.trim());
+		if (!harness) throw new Error(`agent harness not found: ${harnessId.trim()}`);
+		return cloneHarness(harness);
 	}
-	async readMatches(limit = 50) {
+	return matchAgentHarnesses(harnesses, context)[0];
+}
+var FileAgentHarnessStore = class {
+	constructor(filePath = defaultAgentHarnessesFilePath()) {
+		this.filePath = filePath;
+	}
+	async readHarnesses() {
 		try {
-			const matches = (await readFile(this.filePath, "utf8")).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => parseJsonString(line)).filter((match) => Boolean(match)).map(cloneMatch);
-			return (limit > 0 ? matches.slice(-limit) : matches).reverse();
+			const parsed = parseJsonString(await readFile(this.filePath, "utf8"));
+			return (Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.harnesses) ? parsed.harnesses : []).map((harness) => parseHarness(harness)).filter((harness) => Boolean(harness)).map(cloneHarness);
 		} catch {
 			return [];
 		}
 	}
 };
-function defaultAutomationMatchesFilePath() {
-	return defaultGranolaToolkitPersistenceLayout().automationMatchesFile;
+function defaultAgentHarnessesFilePath() {
+	return defaultGranolaToolkitPersistenceLayout().agentHarnessesFile;
 }
-function createDefaultAutomationMatchStore(filePath) {
-	return new FileAutomationMatchStore(filePath);
+function createDefaultAgentHarnessStore(filePath) {
+	return new FileAgentHarnessStore(filePath);
 }
 //#endregion
-//#region src/automation-runs.ts
-function cloneRun(run) {
+//#region src/client/auth.ts
+const execFileAsync$1 = promisify(execFile);
+const DEFAULT_CLIENT_ID = "client_GranolaMac";
+const KEYCHAIN_SERVICE_NAME = "com.granola.toolkit";
+const KEYCHAIN_ACCOUNT_NAME_API_KEY = "api-key";
+const KEYCHAIN_ACCOUNT_NAME = "session";
+const WORKOS_AUTH_URL = "https://api.workos.com/user_management/authenticate";
+function numberValue(value) {
+	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+}
+function parseSessionRecord(record) {
+	const accessToken = stringValue(record.access_token);
+	if (!accessToken.trim()) return;
 	return {
-		...run,
-		folders: run.folders.map((folder) => ({ ...folder })),
-		meta: run.meta ? structuredClone(run.meta) : void 0,
-		tags: [...run.tags]
+		accessToken,
+		clientId: stringValue(record.client_id) || DEFAULT_CLIENT_ID,
+		expiresIn: numberValue(record.expires_in),
+		externalId: stringValue(record.external_id) || void 0,
+		obtainedAt: stringValue(record.obtained_at) || void 0,
+		refreshToken: stringValue(record.refresh_token) || void 0,
+		sessionId: stringValue(record.session_id) || void 0,
+		signInMethod: stringValue(record.sign_in_method) || void 0,
+		tokenType: stringValue(record.token_type) || void 0
 	};
 }
-function sortRuns(runs) {
-	return runs.slice().sort((left, right) => (right.finishedAt ?? right.startedAt).localeCompare(left.finishedAt ?? left.startedAt));
+function parseNestedRecord(value) {
+	if (typeof value === "string") return parseJsonString(value);
+	return asRecord(value);
 }
-function mergeRuns(runs) {
-	const byId = /* @__PURE__ */ new Map();
-	for (const run of runs) byId.set(run.id, cloneRun(run));
-	return sortRuns([...byId.values()]);
+function getSessionFromSupabaseContents(supabaseContents) {
+	const wrapper = parseJsonString(supabaseContents);
+	if (!wrapper) throw new Error("failed to parse supabase.json");
+	const workOsSession = parseSessionRecord(parseNestedRecord(wrapper.workos_tokens) ?? {});
+	if (workOsSession) return workOsSession;
+	const cognitoSession = parseSessionRecord(parseNestedRecord(wrapper.cognito_tokens) ?? {});
+	if (cognitoSession) return cognitoSession;
+	const legacySession = parseSessionRecord(wrapper);
+	if (legacySession) return legacySession;
+	throw new Error("access token not found in supabase.json");
 }
-var FileAutomationRunStore = class {
-	constructor(filePath = defaultAutomationRunsFilePath()) {
+function getAccessTokenFromSupabaseContents(supabaseContents) {
+	return getSessionFromSupabaseContents(supabaseContents).accessToken;
+}
+var SupabaseFileTokenSource = class {
+	constructor(filePath) {
 		this.filePath = filePath;
 	}
-	async appendRuns(runs) {
-		if (runs.length === 0) return;
-		await mkdir(dirname(this.filePath), { recursive: true });
-		const payload = runs.map((run) => JSON.stringify(run)).join("\n");
-		await appendFile(this.filePath, `${payload}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
+	async loadAccessToken() {
+		return getAccessTokenFromSupabaseContents(await readFile(this.filePath, "utf8"));
 	}
-	async readRun(id) {
-		return (await this.readRuns({ limit: 0 })).find((run) => run.id === id);
+};
+var SupabaseFileSessionSource = class {
+	constructor(filePath) {
+		this.filePath = filePath;
 	}
-	async readRuns(options = {}) {
-		try {
-			const runs = mergeRuns((await readFile(this.filePath, "utf8")).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => parseJsonString(line)).filter((run) => Boolean(run))).filter((run) => options.status ? run.status === options.status : true);
-			return (options.limit && options.limit > 0 ? runs.slice(0, options.limit) : runs).map(cloneRun);
-		} catch {
-			return [];
-		}
+	async loadSession() {
+		return getSessionFromSupabaseContents(await readFile(this.filePath, "utf8"));
 	}
 };
-function defaultAutomationRunsFilePath() {
-	return defaultGranolaToolkitPersistenceLayout().automationRunsFile;
+var NoopTokenStore = class {
+	async clearToken() {}
+	async readToken() {}
+	async writeToken(_token) {}
+};
+var FileSessionStore = class {
+	constructor(filePath = defaultSessionFilePath()) {
+		this.filePath = filePath;
+	}
+	async clearSession() {
+		try {
+			await unlink(this.filePath);
+		} catch {}
+	}
+	async readSession() {
+		try {
+			const parsed = parseJsonString(await readFile(this.filePath, "utf8"));
+			return parsed?.accessToken ? parsed : void 0;
+		} catch {
+			return;
+		}
+	}
+	async writeSession(session) {
+		await mkdir(dirname(this.filePath), { recursive: true });
+		await writeFile(this.filePath, `${JSON.stringify(session, null, 2)}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+	}
+};
+var FileApiKeyStore = class {
+	constructor(filePath = defaultApiKeyFilePath()) {
+		this.filePath = filePath;
+	}
+	async clearApiKey() {
+		try {
+			await unlink(this.filePath);
+		} catch {}
+	}
+	async readApiKey() {
+		try {
+			return (await readFile(this.filePath, "utf8")).trim() || void 0;
+		} catch {
+			return;
+		}
+	}
+	async writeApiKey(apiKey) {
+		const trimmed = apiKey.trim();
+		if (!trimmed) throw new Error("Granola API key is required");
+		await mkdir(dirname(this.filePath), { recursive: true });
+		await writeFile(this.filePath, `${trimmed}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
+	}
+};
+var KeychainSessionStore = class {
+	async clearSession() {
+		try {
+			await execFileAsync$1("security", [
+				"delete-generic-password",
+				"-s",
+				KEYCHAIN_SERVICE_NAME,
+				"-a",
+				KEYCHAIN_ACCOUNT_NAME
+			]);
+		} catch {}
+	}
+	async readSession() {
+		try {
+			const { stdout } = await execFileAsync$1("security", [
+				"find-generic-password",
+				"-s",
+				KEYCHAIN_SERVICE_NAME,
+				"-a",
+				KEYCHAIN_ACCOUNT_NAME,
+				"-w"
+			]);
+			const parsed = parseJsonString(stdout.trim());
+			return parsed?.accessToken ? parsed : void 0;
+		} catch {
+			return;
+		}
+	}
+	async writeSession(session) {
+		await execFileAsync$1("security", [
+			"add-generic-password",
+			"-U",
+			"-s",
+			KEYCHAIN_SERVICE_NAME,
+			"-a",
+			KEYCHAIN_ACCOUNT_NAME,
+			"-w",
+			JSON.stringify(session)
+		]);
+	}
+};
+var KeychainApiKeyStore = class {
+	async clearApiKey() {
+		try {
+			await execFileAsync$1("security", [
+				"delete-generic-password",
+				"-s",
+				KEYCHAIN_SERVICE_NAME,
+				"-a",
+				KEYCHAIN_ACCOUNT_NAME_API_KEY
+			]);
+		} catch {}
+	}
+	async readApiKey() {
+		try {
+			const { stdout } = await execFileAsync$1("security", [
+				"find-generic-password",
+				"-s",
+				KEYCHAIN_SERVICE_NAME,
+				"-a",
+				KEYCHAIN_ACCOUNT_NAME_API_KEY,
+				"-w"
+			]);
+			return stdout.trim() || void 0;
+		} catch {
+			return;
+		}
+	}
+	async writeApiKey(apiKey) {
+		const trimmed = apiKey.trim();
+		if (!trimmed) throw new Error("Granola API key is required");
+		await execFileAsync$1("security", [
+			"add-generic-password",
+			"-U",
+			"-s",
+			KEYCHAIN_SERVICE_NAME,
+			"-a",
+			KEYCHAIN_ACCOUNT_NAME_API_KEY,
+			"-w",
+			trimmed
+		]);
+	}
+};
+var CachedTokenProvider = class {
+	#token;
+	constructor(source, store = new NoopTokenStore()) {
+		this.source = source;
+		this.store = store;
+	}
+	async getAccessToken() {
+		if (this.#token) return this.#token;
+		const storedToken = await this.store.readToken();
+		if (storedToken?.trim()) {
+			this.#token = storedToken;
+			return storedToken;
+		}
+		const token = await this.source.loadAccessToken();
+		this.#token = token;
+		await this.store.writeToken(token);
+		return token;
+	}
+	async invalidate() {
+		this.#token = void 0;
+		await this.store.clearToken();
+	}
+};
+var StoredSessionTokenProvider = class {
+	#session;
+	constructor(store, options = {}) {
+		this.store = store;
+		this.options = options;
+	}
+	async loadSession() {
+		if (this.#session) return this.#session;
+		const storedSession = await this.store.readSession();
+		if (storedSession?.accessToken.trim()) {
+			this.#session = storedSession;
+			return storedSession;
+		}
+		if (!this.options.source) throw new Error("no stored Granola session found");
+		const sourcedSession = await this.options.source.loadSession();
+		this.#session = sourcedSession;
+		return sourcedSession;
+	}
+	async getAccessToken() {
+		return (await this.loadSession()).accessToken;
+	}
+	async invalidate() {
+		const session = await this.loadSession().catch(() => void 0);
+		if (session?.refreshToken && session.clientId) try {
+			const refreshedSession = await refreshGranolaSession(session, this.options.fetchImpl);
+			this.#session = refreshedSession;
+			await this.store.writeSession(refreshedSession);
+			return;
+		} catch {
+			if (!this.options.source) {
+				this.#session = void 0;
+				await this.store.clearSession();
+				throw new Error("failed to refresh stored Granola session");
+			}
+		}
+		if (this.options.source) {
+			const sourcedSession = await this.options.source.loadSession();
+			this.#session = sourcedSession;
+			await this.store.writeSession(sourcedSession);
+			return;
+		}
+		this.#session = void 0;
+		await this.store.clearSession();
+	}
+};
+async function refreshGranolaSession(session, fetchImpl = fetch) {
+	if (!session.refreshToken?.trim()) throw new Error("refresh token not available");
+	const response = await fetchImpl(WORKOS_AUTH_URL, {
+		body: JSON.stringify({
+			client_id: session.clientId,
+			grant_type: "refresh_token",
+			refresh_token: session.refreshToken
+		}),
+		headers: { "Content-Type": "application/json" },
+		method: "POST"
+	});
+	if (!response.ok) throw new Error(`failed to refresh session: ${response.status} ${response.statusText}`);
+	const refreshed = parseSessionRecord(await response.json());
+	if (!refreshed) throw new Error("failed to parse refreshed session");
+	return {
+		...session,
+		...refreshed,
+		clientId: refreshed.clientId || session.clientId,
+		obtainedAt: refreshed.obtainedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+		refreshToken: refreshed.refreshToken ?? session.refreshToken
+	};
 }
-function createDefaultAutomationRunStore(filePath) {
-	return new FileAutomationRunStore(filePath);
+function defaultSessionFilePath() {
+	return defaultGranolaToolkitPersistenceLayout().sessionFile;
+}
+function defaultApiKeyFilePath() {
+	return defaultGranolaToolkitPersistenceLayout().apiKeyFile;
+}
+function createDefaultSessionStore() {
+	return defaultGranolaToolkitPersistenceLayout().sessionStoreKind === "keychain" ? new KeychainSessionStore() : new FileSessionStore();
+}
+function createDefaultApiKeyStore() {
+	return defaultGranolaToolkitPersistenceLayout().sessionStoreKind === "keychain" ? new KeychainApiKeyStore() : new FileApiKeyStore();
+}
+//#endregion
+//#region src/client/http.ts
+const RETRYABLE_STATUS_CODES = new Set([
+	429,
+	500,
+	502,
+	503,
+	504
+]);
+function sleep(delayMs) {
+	return new Promise((resolve) => {
+		setTimeout(resolve, delayMs);
+	});
+}
+function parseRetryAfter(headerValue) {
+	if (!headerValue?.trim()) return;
+	if (/^\d+$/.test(headerValue.trim())) return Number(headerValue.trim()) * 1e3;
+	const retryAt = Date.parse(headerValue);
+	if (Number.isNaN(retryAt)) return;
+	return Math.max(0, retryAt - Date.now());
+}
+var AuthenticatedHttpClient = class {
+	fetchImpl;
+	constructor(options) {
+		this.fetchImpl = options.fetchImpl ?? fetch;
+		this.logger = options.logger;
+		this.maxRetries = options.maxRetries ?? 2;
+		this.retryBaseDelayMs = options.retryBaseDelayMs ?? 500;
+		this.retryMaxDelayMs = options.retryMaxDelayMs ?? 5e3;
+		this.sleepImpl = options.sleepImpl ?? sleep;
+		this.tokenProvider = options.tokenProvider;
+	}
+	logger;
+	maxRetries;
+	retryBaseDelayMs;
+	retryMaxDelayMs;
+	sleepImpl;
+	tokenProvider;
+	async retry(options, attempt, reason, response) {
+		const retryAfterMs = parseRetryAfter(response?.headers.get("retry-after") ?? null);
+		const delayMs = Math.min(retryAfterMs ?? this.retryBaseDelayMs * 2 ** attempt, this.retryMaxDelayMs);
+		this.logger?.warn?.(`${reason}; retrying in ${delayMs}ms (${attempt + 1}/${this.maxRetries})`);
+		await this.sleepImpl(delayMs);
+		return this.request(options, attempt + 1);
+	}
+	async request(options, attempt = 0) {
+		const { retryOnUnauthorized = true, timeoutMs, url } = options;
+		const accessToken = await this.tokenProvider.getAccessToken();
+		let response;
+		try {
+			response = await this.fetchImpl(url, {
+				body: options.body,
+				headers: {
+					...options.headers,
+					Authorization: `Bearer ${accessToken}`
+				},
+				method: options.method ?? "GET",
+				signal: AbortSignal.timeout(timeoutMs)
+			});
+		} catch (error) {
+			if (attempt < this.maxRetries) {
+				const message = error instanceof Error ? error.message : String(error);
+				return this.retry(options, attempt, `request failed: ${message}`);
+			}
+			throw error;
+		}
+		if (response.status === 401 && retryOnUnauthorized) {
+			this.logger?.warn?.("request returned 401; invalidating token provider and retrying once");
+			await this.tokenProvider.invalidate();
+			return this.request({
+				...options,
+				retryOnUnauthorized: false
+			}, attempt);
+		}
+		if (RETRYABLE_STATUS_CODES.has(response.status) && attempt < this.maxRetries) return this.retry(options, attempt, `request returned ${response.status} ${response.statusText || ""}`.trim(), response);
+		return response;
+	}
+	async postJson(url, body, options = { timeoutMs: 3e4 }) {
+		return this.request({
+			...options,
+			body: JSON.stringify(body),
+			headers: {
+				Accept: "*/*",
+				"Content-Type": "application/json",
+				...options.headers
+			},
+			method: "POST",
+			url
+		});
+	}
+};
+//#endregion
+//#region src/agents.ts
+const DEFAULT_CODEX_MODEL = "gpt-5-codex";
+const DEFAULT_OPENAI_MODEL = "gpt-5-mini";
+const DEFAULT_OPENROUTER_MODEL = "openai/gpt-5-mini";
+const OPENROUTER_REFERER = "https://github.com/kkarimi/granola-toolkit";
+const OPENROUTER_TITLE = "granola-toolkit";
+function trimString(value) {
+	return value?.trim() ? value.trim() : void 0;
+}
+function resolveProvider(request, config, env) {
+	if (request.provider) return request.provider;
+	if (config.agents?.defaultProvider) return config.agents.defaultProvider;
+	if (trimString(env.OPENROUTER_API_KEY) || trimString(env.GRANOLA_OPENROUTER_API_KEY)) return "openrouter";
+	if (trimString(env.OPENAI_API_KEY) || trimString(env.GRANOLA_OPENAI_API_KEY)) return "openai";
+	return "codex";
+}
+function resolveModel(provider, request, config) {
+	return trimString(request.model) ?? trimString(config.agents?.defaultModel) ?? (provider === "openrouter" ? DEFAULT_OPENROUTER_MODEL : provider === "openai" ? DEFAULT_OPENAI_MODEL : DEFAULT_CODEX_MODEL);
+}
+function resolveTimeoutMs(request, config) {
+	return request.timeoutMs ?? config.agents?.timeoutMs ?? 3e5;
+}
+function resolveRetries(request, config) {
+	return request.retries ?? config.agents?.maxRetries ?? 2;
+}
+function resolveDryRun(request, config) {
+	return request.dryRun ?? config.agents?.dryRun ?? false;
+}
+function openaiApiKey(env) {
+	return trimString(env.OPENAI_API_KEY) ?? trimString(env.GRANOLA_OPENAI_API_KEY);
+}
+function openrouterApiKey(env) {
+	return trimString(env.OPENROUTER_API_KEY) ?? trimString(env.GRANOLA_OPENROUTER_API_KEY);
+}
+async function responseError(response, label) {
+	let details = `${response.status} ${response.statusText}`.trim();
+	try {
+		const payload = await response.json();
+		if (typeof payload.error === "string" && payload.error.trim()) details = payload.error;
+		else if (payload.error && typeof payload.error === "object" && typeof payload.error.message === "string" && payload.error.message.trim()) details = payload.error.message;
+		else if (typeof payload.message === "string" && payload.message.trim()) details = payload.message;
+	} catch {
+		const text = (await response.text()).trim();
+		if (text) details = text;
+	}
+	return /* @__PURE__ */ new Error(`${label}: ${details}`);
+}
+function messageText(content) {
+	if (typeof content === "string") return content.trim();
+	if (!Array.isArray(content)) return "";
+	return content.map((part) => {
+		if (part && typeof part === "object" && "type" in part && part.type === "text" && "text" in part && typeof part.text === "string") return part.text;
+		return "";
+	}).join("").trim();
+}
+async function runCodexCliCommand(request) {
+	const tempDirectory = await mkdtemp(join(tmpdir(), "granola-toolkit-codex-"));
+	const outputFile = join(tempDirectory, "last-message.txt");
+	const args = [
+		"exec",
+		"--skip-git-repo-check",
+		"--color",
+		"never"
+	];
+	if (request.cwd) args.push("-C", request.cwd);
+	if (request.model) args.push("-m", request.model);
+	args.push("--output-last-message", outputFile, "-");
+	const commandText = [request.command, ...args].join(" ");
+	try {
+		return {
+			command: commandText,
+			output: await new Promise((resolve$1, reject) => {
+				const child = spawn(request.command, args, {
+					cwd: request.cwd ? resolve(request.cwd) : process.cwd(),
+					env: process.env,
+					stdio: [
+						"pipe",
+						"pipe",
+						"pipe"
+					]
+				});
+				const stdoutChunks = [];
+				const stderrChunks = [];
+				let timedOut = false;
+				const timeout = setTimeout(() => {
+					timedOut = true;
+					child.kill("SIGTERM");
+				}, request.timeoutMs);
+				child.stdout.on("data", (chunk) => {
+					stdoutChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+				});
+				child.stderr.on("data", (chunk) => {
+					stderrChunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+				});
+				child.on("error", (error) => {
+					clearTimeout(timeout);
+					reject(error);
+				});
+				child.on("close", async (code) => {
+					clearTimeout(timeout);
+					const stdout = Buffer.concat(stdoutChunks).toString("utf8").trim();
+					const stderr = Buffer.concat(stderrChunks).toString("utf8").trim();
+					if (timedOut) {
+						reject(/* @__PURE__ */ new Error(`codex provider timed out after ${request.timeoutMs}ms`));
+						return;
+					}
+					if (code !== 0) {
+						reject(new Error(stderr || stdout || `codex exited with status ${String(code)}`));
+						return;
+					}
+					try {
+						resolve$1((await readFile(outputFile, "utf8")).trim() || stdout || void 0);
+					} catch {
+						resolve$1(stdout || void 0);
+					}
+				});
+				child.stdin.write(request.prompt);
+				child.stdin.end();
+			})
+		};
+	} finally {
+		await rm(tempDirectory, {
+			force: true,
+			recursive: true
+		}).catch(() => void 0);
+	}
+}
+async function runOpenAiCompatibleRequest(options) {
+	const response = await new AuthenticatedHttpClient({
+		fetchImpl: options.fetchImpl,
+		maxRetries: options.maxRetries,
+		tokenProvider: new CachedTokenProvider({ async loadAccessToken() {
+			return options.token;
+		} })
+	}).postJson(`${options.baseUrl.replace(/\/$/, "")}/chat/completions`, {
+		messages: [...options.systemPrompt ? [{
+			content: options.systemPrompt,
+			role: "system"
+		}] : [], {
+			content: options.prompt,
+			role: "user"
+		}],
+		model: options.model
+	}, {
+		headers: {
+			Accept: "application/json",
+			...options.headers
+		},
+		timeoutMs: options.timeoutMs
+	});
+	if (!response.ok) throw await responseError(response, options.label);
+	const content = (await response.json()).choices?.[0]?.message?.content;
+	return messageText(content) || void 0;
 }
-//#endregion
-//#region src/automation-rules.ts
-function cloneRule(rule) {
-	return {
-		...rule,
-		actions: rule.actions?.map((action) => cloneAction(action)),
-		when: {
-			...rule.when,
-			eventKinds: rule.when.eventKinds ? [...rule.when.eventKinds] : void 0,
-			folderIds: rule.when.folderIds ? [...rule.when.folderIds] : void 0,
-			folderNames: rule.when.folderNames ? [...rule.when.folderNames] : void 0,
-			meetingIds: rule.when.meetingIds ? [...rule.when.meetingIds] : void 0,
-			tags: rule.when.tags ? [...rule.when.tags] : void 0,
-			titleIncludes: rule.when.titleIncludes ? [...rule.when.titleIncludes] : void 0
+function createDefaultAutomationAgentRunner(config, options = {}) {
+	const env = options.env ?? process.env;
+	const runCodexCommand = options.runCodexCommand ?? runCodexCliCommand;
+	return { async run(request) {
+		const provider = resolveProvider(request, config, env);
+		const model = resolveModel(provider, request, config);
+		const timeoutMs = resolveTimeoutMs(request, config);
+		const retries = resolveRetries(request, config);
+		const dryRun = resolveDryRun(request, config);
+		if (dryRun) return {
+			dryRun,
+			model,
+			output: void 0,
+			prompt: request.prompt,
+			provider,
+			systemPrompt: request.systemPrompt
+		};
+		if (provider === "codex") {
+			const result = await runCodexCommand({
+				command: config.agents?.codexCommand ?? "codex",
+				cwd: request.cwd,
+				model,
+				prompt: request.systemPrompt ? `${request.systemPrompt.trim()}\n\n${request.prompt}` : request.prompt,
+				timeoutMs
+			});
+			return {
+				command: result.command,
+				dryRun,
+				model,
+				output: result.output,
+				prompt: request.prompt,
+				provider,
+				systemPrompt: request.systemPrompt
+			};
 		}
-	};
+		const token = provider === "openrouter" ? openrouterApiKey(env) : openaiApiKey(env);
+		if (!token) throw new Error(provider === "openrouter" ? "OpenRouter API key not found. Set OPENROUTER_API_KEY or GRANOLA_OPENROUTER_API_KEY." : "OpenAI API key not found. Set OPENAI_API_KEY or GRANOLA_OPENAI_API_KEY.");
+		return {
+			dryRun,
+			model,
+			output: await runOpenAiCompatibleRequest({
+				baseUrl: provider === "openrouter" ? config.agents?.openrouterBaseUrl ?? "https://openrouter.ai/api/v1" : config.agents?.openaiBaseUrl ?? "https://api.openai.com/v1",
+				fetchImpl: options.fetchImpl,
+				headers: provider === "openrouter" ? {
+					"HTTP-Referer": OPENROUTER_REFERER,
+					"X-Title": OPENROUTER_TITLE
+				} : void 0,
+				label: provider === "openrouter" ? "OpenRouter request failed" : "OpenAI request failed",
+				maxRetries: retries,
+				model,
+				prompt: request.prompt,
+				systemPrompt: request.systemPrompt,
+				timeoutMs,
+				token
+			}),
+			prompt: request.prompt,
+			provider,
+			systemPrompt: request.systemPrompt
+		};
+	} };
 }
-function cloneAction(action) {
+//#endregion
+//#region src/automation-actions.ts
+function cloneAction$1(action) {
 	switch (action.kind) {
+		case "agent": return { ...action };
 		case "ask-user": return { ...action };
 		case "command": return {
 			...action,
@@ -2862,518 +3389,483 @@ function cloneAction(action) {
 		case "export-transcript": return { ...action };
 	}
 }
-function stringArray(value) {
-	if (!Array.isArray(value)) return;
-	const values = value.filter((item) => typeof item === "string" && item.trim().length > 0);
-	return values.length > 0 ? [...new Set(values.map((item) => item.trim()))] : void 0;
-}
-function stringRecord(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const entries = Object.entries(value).filter(([key, item]) => {
-		return typeof key === "string" && key.trim().length > 0 && typeof item === "string" && item.trim().length > 0;
-	});
-	if (entries.length === 0) return;
-	return Object.fromEntries(entries.map(([key, item]) => [key.trim(), item.trim()]));
-}
-function parseAction(value, index) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const record = value;
-	const kind = typeof record.kind === "string" && record.kind.trim() ? record.kind.trim() : void 0;
-	const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : kind ? `${kind}-${index + 1}` : void 0;
-	const name = typeof record.name === "string" && record.name.trim() ? record.name.trim() : void 0;
-	const enabled = typeof record.enabled === "boolean" ? record.enabled : void 0;
-	switch (kind) {
-		case "ask-user": {
-			const prompt = typeof record.prompt === "string" && record.prompt.trim() ? record.prompt.trim() : void 0;
-			if (!id || !prompt) return;
-			return {
-				details: typeof record.details === "string" && record.details.trim() ? record.details.trim() : void 0,
-				enabled,
-				id,
-				kind,
-				name,
-				prompt
-			};
-		}
-		case "command": {
-			const command = typeof record.command === "string" && record.command.trim() ? record.command.trim() : void 0;
-			if (!id || !command) return;
-			return {
-				args: stringArray(record.args),
-				command,
-				cwd: typeof record.cwd === "string" && record.cwd.trim() ? record.cwd.trim() : void 0,
-				enabled,
-				env: stringRecord(record.env),
-				id,
-				kind,
-				name,
-				stdin: record.stdin === "json" || record.stdin === "none" ? record.stdin : void 0,
-				timeoutMs: typeof record.timeoutMs === "number" && Number.isFinite(record.timeoutMs) ? record.timeoutMs : typeof record.timeoutMs === "string" && /^\d+$/.test(record.timeoutMs) ? Number(record.timeoutMs) : void 0
-			};
-		}
-		case "export-notes":
-			if (!id) return;
-			return {
-				enabled,
-				format: record.format === "json" || record.format === "markdown" || record.format === "raw" || record.format === "yaml" ? record.format : void 0,
-				id,
-				kind,
-				name,
-				outputDir: typeof record.outputDir === "string" && record.outputDir.trim() ? record.outputDir.trim() : void 0,
-				scopedOutput: typeof record.scopedOutput === "boolean" ? record.scopedOutput : void 0
-			};
-		case "export-transcript":
-			if (!id) return;
-			return {
-				enabled,
-				format: record.format === "json" || record.format === "raw" || record.format === "text" || record.format === "yaml" ? record.format : void 0,
-				id,
-				kind,
-				name,
-				outputDir: typeof record.outputDir === "string" && record.outputDir.trim() ? record.outputDir.trim() : void 0,
-				scopedOutput: typeof record.scopedOutput === "boolean" ? record.scopedOutput : void 0
-			};
-		default: return;
-	}
-}
-function parseRule(value) {
-	if (!value || typeof value !== "object" || Array.isArray(value)) return;
-	const record = value;
-	const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : void 0;
-	const name = typeof record.name === "string" && record.name.trim() ? record.name.trim() : void 0;
-	const whenValue = record.when && typeof record.when === "object" && !Array.isArray(record.when) ? record.when : void 0;
-	if (!id || !name || !whenValue) return;
-	return {
-		actions: Array.isArray(record.actions) ? record.actions.map((action, index) => parseAction(action, index)).filter((action) => Boolean(action)) : void 0,
-		enabled: typeof record.enabled === "boolean" ? record.enabled : void 0,
-		id,
-		name,
-		when: {
-			eventKinds: stringArray(whenValue.eventKinds),
-			folderIds: stringArray(whenValue.folderIds),
-			folderNames: stringArray(whenValue.folderNames),
-			meetingIds: stringArray(whenValue.meetingIds),
-			tags: stringArray(whenValue.tags),
-			titleIncludes: stringArray(whenValue.titleIncludes),
-			titleMatches: typeof whenValue.titleMatches === "string" && whenValue.titleMatches.trim() ? whenValue.titleMatches.trim() : void 0,
-			transcriptLoaded: typeof whenValue.transcriptLoaded === "boolean" ? whenValue.transcriptLoaded : void 0
-		}
-	};
-}
-var FileAutomationRuleStore = class {
-	constructor(filePath = defaultAutomationRulesFilePath()) {
-		this.filePath = filePath;
-	}
-	async readRules() {
-		try {
-			const parsed = parseJsonString(await readFile(this.filePath, "utf8"));
-			return (Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.rules) ? parsed.rules : []).map((rule) => parseRule(rule)).filter((rule) => Boolean(rule)).map(cloneRule);
-		} catch {
-			return [];
-		}
-	}
-};
-function defaultAutomationRulesFilePath() {
-	return defaultGranolaToolkitPersistenceLayout().automationRulesFile;
-}
-function includesIgnoreCase(candidate, values) {
-	const lowerCandidate = candidate.toLowerCase();
-	return values.some((value) => lowerCandidate.includes(value.toLowerCase()));
-}
-function matchesRule(rule, event) {
-	if (rule.enabled === false) return false;
-	const { when } = rule;
-	if (when.eventKinds?.length && !when.eventKinds.includes(event.kind)) return false;
-	if (when.meetingIds?.length && !when.meetingIds.includes(event.meetingId)) return false;
-	if (when.folderIds?.length && !event.folders.some((folder) => when.folderIds?.includes(folder.id))) return false;
-	if (when.folderNames?.length && !event.folders.some((folder) => when.folderNames?.includes(folder.name))) return false;
-	if (when.tags?.length && !event.tags.some((tag) => when.tags?.includes(tag))) return false;
-	if (when.titleIncludes?.length && !includesIgnoreCase(event.title, when.titleIncludes)) return false;
-	if (when.titleMatches) try {
-		if (!new RegExp(when.titleMatches, "i").test(event.title)) return false;
-	} catch {
-		return false;
-	}
-	if (typeof when.transcriptLoaded === "boolean" && when.transcriptLoaded !== event.transcriptLoaded) return false;
-	return true;
-}
-function matchAutomationRules(rules, events, matchedAt) {
-	const matches = [];
-	for (const event of events) for (const rule of rules) {
-		if (!matchesRule(rule, event)) continue;
-		matches.push({
-			eventId: event.id,
-			eventKind: event.kind,
-			folders: event.folders.map((folder) => ({ ...folder })),
-			id: `${event.id}:${rule.id}`,
-			matchedAt,
-			meetingId: event.meetingId,
-			ruleId: rule.id,
-			ruleName: rule.name,
-			tags: [...event.tags],
-			title: event.title,
-			transcriptLoaded: event.transcriptLoaded
-		});
-	}
-	return matches;
-}
-function createDefaultAutomationRuleStore(filePath) {
-	return new FileAutomationRuleStore(filePath);
+function automationActionName(action) {
+	return action.name || action.id;
 }
-//#endregion
-//#region src/cache.ts
-function parseCacheDocument(id, value) {
-	const record = asRecord(value);
-	if (!record) return;
-	return {
-		createdAt: stringValue(record.created_at),
-		id,
-		title: stringValue(record.title),
-		updatedAt: stringValue(record.updated_at)
-	};
+function buildAutomationActionRunId(match, actionId) {
+	return `${match.id}:${actionId}`;
 }
-function parseTranscriptSegments(value) {
-	if (!Array.isArray(value)) return;
-	return value.flatMap((segment) => {
-		const record = asRecord(segment);
-		if (!record) return [];
-		return [{
-			documentId: stringValue(record.document_id),
-			endTimestamp: stringValue(record.end_timestamp),
-			id: stringValue(record.id),
-			isFinal: Boolean(record.is_final),
-			source: stringValue(record.source),
-			startTimestamp: stringValue(record.start_timestamp),
-			text: stringValue(record.text)
-		}];
-	});
+function enabledAutomationActions(rule) {
+	return (rule.actions ?? []).filter((action) => action.enabled !== false).map((action) => cloneAction$1(action));
 }
-function parseCacheContents(contents) {
-	const outer = parseJsonString(contents);
-	if (!outer) throw new Error("failed to parse cache JSON");
-	const rawCache = outer.cache;
-	let cachePayload;
-	if (typeof rawCache === "string") cachePayload = parseJsonString(rawCache);
-	else cachePayload = asRecord(rawCache);
-	const state = cachePayload ? asRecord(cachePayload.state) : void 0;
-	if (!state) throw new Error("failed to parse cache state");
-	const rawDocuments = asRecord(state.documents) ?? {};
-	const rawTranscripts = asRecord(state.transcripts) ?? {};
-	const documents = {};
-	for (const [id, rawDocument] of Object.entries(rawDocuments)) {
-		const document = parseCacheDocument(id, rawDocument);
-		if (document) documents[id] = document;
-	}
-	const transcripts = {};
-	for (const [id, rawTranscript] of Object.entries(rawTranscripts)) {
-		const segments = parseTranscriptSegments(rawTranscript);
-		if (segments) transcripts[id] = segments;
-	}
+function baseRun(match, rule, action, startedAt) {
 	return {
-		documents,
-		transcripts
+		actionId: action.id,
+		actionKind: action.kind,
+		actionName: automationActionName(action),
+		eventId: match.eventId,
+		eventKind: match.eventKind,
+		folders: match.folders.map((folder) => ({ ...folder })),
+		id: buildAutomationActionRunId(match, action.id),
+		matchedAt: match.matchedAt,
+		meetingId: match.meetingId,
+		ruleId: rule.id,
+		ruleName: rule.name,
+		startedAt,
+		status: "completed",
+		tags: [...match.tags],
+		title: match.title,
+		transcriptLoaded: match.transcriptLoaded
 	};
 }
-//#endregion
-//#region src/client/auth.ts
-const execFileAsync$1 = promisify(execFile);
-const DEFAULT_CLIENT_ID = "client_GranolaMac";
-const KEYCHAIN_SERVICE_NAME = "com.granola.toolkit";
-const KEYCHAIN_ACCOUNT_NAME_API_KEY = "api-key";
-const KEYCHAIN_ACCOUNT_NAME = "session";
-const WORKOS_AUTH_URL = "https://api.workos.com/user_management/authenticate";
-function numberValue(value) {
-	return typeof value === "number" && Number.isFinite(value) ? value : void 0;
+function completedRun(run, finishedAt, patch = {}) {
+	return {
+		...run,
+		...patch,
+		finishedAt,
+		status: "completed"
+	};
 }
-function parseSessionRecord(record) {
-	const accessToken = stringValue(record.access_token);
-	if (!accessToken.trim()) return;
+function failedRun(run, finishedAt, error) {
 	return {
-		accessToken,
-		clientId: stringValue(record.client_id) || DEFAULT_CLIENT_ID,
-		expiresIn: numberValue(record.expires_in),
-		externalId: stringValue(record.external_id) || void 0,
-		obtainedAt: stringValue(record.obtained_at) || void 0,
-		refreshToken: stringValue(record.refresh_token) || void 0,
-		sessionId: stringValue(record.session_id) || void 0,
-		signInMethod: stringValue(record.sign_in_method) || void 0,
-		tokenType: stringValue(record.token_type) || void 0
+		...run,
+		error: error instanceof Error ? error.message : String(error),
+		finishedAt,
+		status: "failed"
 	};
 }
-function parseNestedRecord(value) {
-	if (typeof value === "string") return parseJsonString(value);
-	return asRecord(value);
+function skippedRun(run, finishedAt, reason) {
+	return {
+		...run,
+		finishedAt,
+		result: reason,
+		status: "skipped"
+	};
 }
-function getSessionFromSupabaseContents(supabaseContents) {
-	const wrapper = parseJsonString(supabaseContents);
-	if (!wrapper) throw new Error("failed to parse supabase.json");
-	const workOsSession = parseSessionRecord(parseNestedRecord(wrapper.workos_tokens) ?? {});
-	if (workOsSession) return workOsSession;
-	const cognitoSession = parseSessionRecord(parseNestedRecord(wrapper.cognito_tokens) ?? {});
-	if (cognitoSession) return cognitoSession;
-	const legacySession = parseSessionRecord(wrapper);
-	if (legacySession) return legacySession;
-	throw new Error("access token not found in supabase.json");
+async function executeAutomationAction(match, rule, action, handlers) {
+	const run = baseRun(match, rule, action, handlers.nowIso());
+	switch (action.kind) {
+		case "agent": try {
+			const result = await handlers.runAgent(match, rule, action);
+			return completedRun(run, handlers.nowIso(), {
+				meta: {
+					command: result.command,
+					dryRun: result.dryRun,
+					model: result.model,
+					provider: result.provider,
+					systemPrompt: result.systemPrompt
+				},
+				prompt: result.prompt,
+				result: result.output ?? (result.dryRun ? "Dry run: provider request not executed" : "")
+			});
+		} catch (error) {
+			return failedRun(run, handlers.nowIso(), error);
+		}
+		case "ask-user": return {
+			...run,
+			meta: action.details ? { details: action.details } : void 0,
+			prompt: action.prompt,
+			result: "Pending user decision",
+			status: "pending"
+		};
+		case "command": try {
+			const result = await handlers.runCommand(match, rule, action);
+			return completedRun(run, handlers.nowIso(), {
+				meta: {
+					command: result.command,
+					cwd: result.cwd
+				},
+				result: result.output
+			});
+		} catch (error) {
+			return failedRun(run, handlers.nowIso(), error);
+		}
+		case "export-notes": try {
+			const result = await handlers.exportNotes(match, action);
+			if (!result) return skippedRun(run, handlers.nowIso(), "Meeting notes were unavailable for export");
+			return completedRun(run, handlers.nowIso(), {
+				meta: {
+					format: result.format,
+					outputDir: result.outputDir,
+					scope: result.scope,
+					written: result.written
+				},
+				result: `Exported notes to ${result.outputDir}`
+			});
+		} catch (error) {
+			return failedRun(run, handlers.nowIso(), error);
+		}
+		case "export-transcript": try {
+			const result = await handlers.exportTranscripts(match, action);
+			if (!result) return skippedRun(run, handlers.nowIso(), "Transcript data was unavailable for export");
+			return completedRun(run, handlers.nowIso(), {
+				meta: {
+					format: result.format,
+					outputDir: result.outputDir,
+					scope: result.scope,
+					written: result.written
+				},
+				result: `Exported transcript to ${result.outputDir}`
+			});
+		} catch (error) {
+			return failedRun(run, handlers.nowIso(), error);
+		}
+	}
 }
-function getAccessTokenFromSupabaseContents(supabaseContents) {
-	return getSessionFromSupabaseContents(supabaseContents).accessToken;
+//#endregion
+//#region src/automation-matches.ts
+function cloneMatch(match) {
+	return {
+		...match,
+		folders: match.folders.map((folder) => ({ ...folder })),
+		tags: [...match.tags]
+	};
 }
-var SupabaseFileTokenSource = class {
-	constructor(filePath) {
-		this.filePath = filePath;
-	}
-	async loadAccessToken() {
-		return getAccessTokenFromSupabaseContents(await readFile(this.filePath, "utf8"));
-	}
-};
-var SupabaseFileSessionSource = class {
-	constructor(filePath) {
-		this.filePath = filePath;
-	}
-	async loadSession() {
-		return getSessionFromSupabaseContents(await readFile(this.filePath, "utf8"));
-	}
-};
-var NoopTokenStore = class {
-	async clearToken() {}
-	async readToken() {}
-	async writeToken(_token) {}
-};
-var FileSessionStore = class {
-	constructor(filePath = defaultSessionFilePath()) {
+var FileAutomationMatchStore = class {
+	constructor(filePath = defaultAutomationMatchesFilePath()) {
 		this.filePath = filePath;
 	}
-	async clearSession() {
-		try {
-			await unlink(this.filePath);
-		} catch {}
-	}
-	async readSession() {
-		try {
-			const parsed = parseJsonString(await readFile(this.filePath, "utf8"));
-			return parsed?.accessToken ? parsed : void 0;
-		} catch {
-			return;
-		}
-	}
-	async writeSession(session) {
+	async appendMatches(matches) {
+		if (matches.length === 0) return;
 		await mkdir(dirname(this.filePath), { recursive: true });
-		await writeFile(this.filePath, `${JSON.stringify(session, null, 2)}\n`, {
+		const payload = matches.map((match) => JSON.stringify(match)).join("\n");
+		await appendFile(this.filePath, `${payload}\n`, {
 			encoding: "utf8",
 			mode: 384
 		});
 	}
-};
-var FileApiKeyStore = class {
-	constructor(filePath = defaultApiKeyFilePath()) {
-		this.filePath = filePath;
-	}
-	async clearApiKey() {
-		try {
-			await unlink(this.filePath);
-		} catch {}
-	}
-	async readApiKey() {
+	async readMatches(limit = 50) {
 		try {
-			return (await readFile(this.filePath, "utf8")).trim() || void 0;
+			const matches = (await readFile(this.filePath, "utf8")).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => parseJsonString(line)).filter((match) => Boolean(match)).map(cloneMatch);
+			return (limit > 0 ? matches.slice(-limit) : matches).reverse();
 		} catch {
-			return;
+			return [];
 		}
 	}
-	async writeApiKey(apiKey) {
-		const trimmed = apiKey.trim();
-		if (!trimmed) throw new Error("Granola API key is required");
-		await mkdir(dirname(this.filePath), { recursive: true });
-		await writeFile(this.filePath, `${trimmed}\n`, {
-			encoding: "utf8",
-			mode: 384
-		});
-	}
 };
-var KeychainSessionStore = class {
-	async clearSession() {
-		try {
-			await execFileAsync$1("security", [
-				"delete-generic-password",
-				"-s",
-				KEYCHAIN_SERVICE_NAME,
-				"-a",
-				KEYCHAIN_ACCOUNT_NAME
-			]);
-		} catch {}
-	}
-	async readSession() {
-		try {
-			const { stdout } = await execFileAsync$1("security", [
-				"find-generic-password",
-				"-s",
-				KEYCHAIN_SERVICE_NAME,
-				"-a",
-				KEYCHAIN_ACCOUNT_NAME,
-				"-w"
-			]);
-			const parsed = parseJsonString(stdout.trim());
-			return parsed?.accessToken ? parsed : void 0;
-		} catch {
-			return;
-		}
+function defaultAutomationMatchesFilePath() {
+	return defaultGranolaToolkitPersistenceLayout().automationMatchesFile;
+}
+function createDefaultAutomationMatchStore(filePath) {
+	return new FileAutomationMatchStore(filePath);
+}
+//#endregion
+//#region src/automation-runs.ts
+function cloneRun(run) {
+	return {
+		...run,
+		folders: run.folders.map((folder) => ({ ...folder })),
+		meta: run.meta ? structuredClone(run.meta) : void 0,
+		tags: [...run.tags]
+	};
+}
+function sortRuns(runs) {
+	return runs.slice().sort((left, right) => (right.finishedAt ?? right.startedAt).localeCompare(left.finishedAt ?? left.startedAt));
+}
+function mergeRuns(runs) {
+	const byId = /* @__PURE__ */ new Map();
+	for (const run of runs) byId.set(run.id, cloneRun(run));
+	return sortRuns([...byId.values()]);
+}
+var FileAutomationRunStore = class {
+	constructor(filePath = defaultAutomationRunsFilePath()) {
+		this.filePath = filePath;
 	}
-	async writeSession(session) {
-		await execFileAsync$1("security", [
-			"add-generic-password",
-			"-U",
-			"-s",
-			KEYCHAIN_SERVICE_NAME,
-			"-a",
-			KEYCHAIN_ACCOUNT_NAME,
-			"-w",
-			JSON.stringify(session)
-		]);
+	async appendRuns(runs) {
+		if (runs.length === 0) return;
+		await mkdir(dirname(this.filePath), { recursive: true });
+		const payload = runs.map((run) => JSON.stringify(run)).join("\n");
+		await appendFile(this.filePath, `${payload}\n`, {
+			encoding: "utf8",
+			mode: 384
+		});
 	}
-};
-var KeychainApiKeyStore = class {
-	async clearApiKey() {
-		try {
-			await execFileAsync$1("security", [
-				"delete-generic-password",
-				"-s",
-				KEYCHAIN_SERVICE_NAME,
-				"-a",
-				KEYCHAIN_ACCOUNT_NAME_API_KEY
-			]);
-		} catch {}
+	async readRun(id) {
+		return (await this.readRuns({ limit: 0 })).find((run) => run.id === id);
 	}
-	async readApiKey() {
+	async readRuns(options = {}) {
 		try {
-			const { stdout } = await execFileAsync$1("security", [
-				"find-generic-password",
-				"-s",
-				KEYCHAIN_SERVICE_NAME,
-				"-a",
-				KEYCHAIN_ACCOUNT_NAME_API_KEY,
-				"-w"
-			]);
-			return stdout.trim() || void 0;
+			const runs = mergeRuns((await readFile(this.filePath, "utf8")).split("\n").map((line) => line.trim()).filter(Boolean).map((line) => parseJsonString(line)).filter((run) => Boolean(run))).filter((run) => options.status ? run.status === options.status : true);
+			return (options.limit && options.limit > 0 ? runs.slice(0, options.limit) : runs).map(cloneRun);
 		} catch {
-			return;
+			return [];
 		}
 	}
-	async writeApiKey(apiKey) {
-		const trimmed = apiKey.trim();
-		if (!trimmed) throw new Error("Granola API key is required");
-		await execFileAsync$1("security", [
-			"add-generic-password",
-			"-U",
-			"-s",
-			KEYCHAIN_SERVICE_NAME,
-			"-a",
-			KEYCHAIN_ACCOUNT_NAME_API_KEY,
-			"-w",
-			trimmed
-		]);
-	}
 };
-var CachedTokenProvider = class {
-	#token;
-	constructor(source, store = new NoopTokenStore()) {
-		this.source = source;
-		this.store = store;
-	}
-	async getAccessToken() {
-		if (this.#token) return this.#token;
-		const storedToken = await this.store.readToken();
-		if (storedToken?.trim()) {
-			this.#token = storedToken;
-			return storedToken;
+function defaultAutomationRunsFilePath() {
+	return defaultGranolaToolkitPersistenceLayout().automationRunsFile;
+}
+function createDefaultAutomationRunStore(filePath) {
+	return new FileAutomationRunStore(filePath);
+}
+//#endregion
+//#region src/automation-rules.ts
+function cloneRule(rule) {
+	return {
+		...rule,
+		actions: rule.actions?.map((action) => cloneAction(action)),
+		when: {
+			...rule.when,
+			eventKinds: rule.when.eventKinds ? [...rule.when.eventKinds] : void 0,
+			folderIds: rule.when.folderIds ? [...rule.when.folderIds] : void 0,
+			folderNames: rule.when.folderNames ? [...rule.when.folderNames] : void 0,
+			meetingIds: rule.when.meetingIds ? [...rule.when.meetingIds] : void 0,
+			tags: rule.when.tags ? [...rule.when.tags] : void 0,
+			titleIncludes: rule.when.titleIncludes ? [...rule.when.titleIncludes] : void 0
 		}
-		const token = await this.source.loadAccessToken();
-		this.#token = token;
-		await this.store.writeToken(token);
-		return token;
-	}
-	async invalidate() {
-		this.#token = void 0;
-		await this.store.clearToken();
-	}
-};
-var StoredSessionTokenProvider = class {
-	#session;
-	constructor(store, options = {}) {
-		this.store = store;
-		this.options = options;
+	};
+}
+function cloneAction(action) {
+	switch (action.kind) {
+		case "agent": return { ...action };
+		case "ask-user": return { ...action };
+		case "command": return {
+			...action,
+			args: action.args ? [...action.args] : void 0,
+			env: action.env ? { ...action.env } : void 0
+		};
+		case "export-notes":
+		case "export-transcript": return { ...action };
 	}
-	async loadSession() {
-		if (this.#session) return this.#session;
-		const storedSession = await this.store.readSession();
-		if (storedSession?.accessToken.trim()) {
-			this.#session = storedSession;
-			return storedSession;
+}
+function stringArray(value) {
+	if (!Array.isArray(value)) return;
+	const values = value.filter((item) => typeof item === "string" && item.trim().length > 0);
+	return values.length > 0 ? [...new Set(values.map((item) => item.trim()))] : void 0;
+}
+function stringRecord(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const entries = Object.entries(value).filter(([key, item]) => {
+		return typeof key === "string" && key.trim().length > 0 && typeof item === "string" && item.trim().length > 0;
+	});
+	if (entries.length === 0) return;
+	return Object.fromEntries(entries.map(([key, item]) => [key.trim(), item.trim()]));
+}
+function parseAction(value, index) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const record = value;
+	const kind = typeof record.kind === "string" && record.kind.trim() ? record.kind.trim() : void 0;
+	const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : kind ? `${kind}-${index + 1}` : void 0;
+	const name = typeof record.name === "string" && record.name.trim() ? record.name.trim() : void 0;
+	const enabled = typeof record.enabled === "boolean" ? record.enabled : void 0;
+	switch (kind) {
+		case "agent": {
+			if (!id) return;
+			const provider = record.provider === "codex" || record.provider === "openai" || record.provider === "openrouter" ? record.provider : void 0;
+			const prompt = typeof record.prompt === "string" && record.prompt.trim() ? record.prompt.trim() : void 0;
+			const promptFile = typeof record.promptFile === "string" && record.promptFile.trim() ? record.promptFile.trim() : void 0;
+			const harnessId = typeof record.harnessId === "string" && record.harnessId.trim() ? record.harnessId.trim() : void 0;
+			const systemPrompt = typeof record.systemPrompt === "string" && record.systemPrompt.trim() ? record.systemPrompt.trim() : void 0;
+			const systemPromptFile = typeof record.systemPromptFile === "string" && record.systemPromptFile.trim() ? record.systemPromptFile.trim() : void 0;
+			if (!prompt && !promptFile && !harnessId) return;
+			return {
+				cwd: typeof record.cwd === "string" && record.cwd.trim() ? record.cwd.trim() : void 0,
+				dryRun: typeof record.dryRun === "boolean" ? record.dryRun : void 0,
+				enabled,
+				harnessId,
+				id,
+				kind,
+				model: typeof record.model === "string" && record.model.trim() ? record.model.trim() : void 0,
+				name,
+				prompt,
+				promptFile,
+				provider,
+				retries: typeof record.retries === "number" && Number.isFinite(record.retries) ? record.retries : typeof record.retries === "string" && /^\d+$/.test(record.retries) ? Number(record.retries) : void 0,
+				systemPrompt,
+				systemPromptFile,
+				timeoutMs: typeof record.timeoutMs === "number" && Number.isFinite(record.timeoutMs) ? record.timeoutMs : typeof record.timeoutMs === "string" && /^\d+$/.test(record.timeoutMs) ? Number(record.timeoutMs) : void 0
+			};
 		}
-		if (!this.options.source) throw new Error("no stored Granola session found");
-		const sourcedSession = await this.options.source.loadSession();
-		this.#session = sourcedSession;
-		return sourcedSession;
-	}
-	async getAccessToken() {
-		return (await this.loadSession()).accessToken;
+		case "ask-user": {
+			const prompt = typeof record.prompt === "string" && record.prompt.trim() ? record.prompt.trim() : void 0;
+			if (!id || !prompt) return;
+			return {
+				details: typeof record.details === "string" && record.details.trim() ? record.details.trim() : void 0,
+				enabled,
+				id,
+				kind,
+				name,
+				prompt
+			};
+		}
+		case "command": {
+			const command = typeof record.command === "string" && record.command.trim() ? record.command.trim() : void 0;
+			if (!id || !command) return;
+			return {
+				args: stringArray(record.args),
+				command,
+				cwd: typeof record.cwd === "string" && record.cwd.trim() ? record.cwd.trim() : void 0,
+				enabled,
+				env: stringRecord(record.env),
+				id,
+				kind,
+				name,
+				stdin: record.stdin === "json" || record.stdin === "none" ? record.stdin : void 0,
+				timeoutMs: typeof record.timeoutMs === "number" && Number.isFinite(record.timeoutMs) ? record.timeoutMs : typeof record.timeoutMs === "string" && /^\d+$/.test(record.timeoutMs) ? Number(record.timeoutMs) : void 0
+			};
+		}
+		case "export-notes":
+			if (!id) return;
+			return {
+				enabled,
+				format: record.format === "json" || record.format === "markdown" || record.format === "raw" || record.format === "yaml" ? record.format : void 0,
+				id,
+				kind,
+				name,
+				outputDir: typeof record.outputDir === "string" && record.outputDir.trim() ? record.outputDir.trim() : void 0,
+				scopedOutput: typeof record.scopedOutput === "boolean" ? record.scopedOutput : void 0
+			};
+		case "export-transcript":
+			if (!id) return;
+			return {
+				enabled,
+				format: record.format === "json" || record.format === "raw" || record.format === "text" || record.format === "yaml" ? record.format : void 0,
+				id,
+				kind,
+				name,
+				outputDir: typeof record.outputDir === "string" && record.outputDir.trim() ? record.outputDir.trim() : void 0,
+				scopedOutput: typeof record.scopedOutput === "boolean" ? record.scopedOutput : void 0
+			};
+		default: return;
 	}
-	async invalidate() {
-		const session = await this.loadSession().catch(() => void 0);
-		if (session?.refreshToken && session.clientId) try {
-			const refreshedSession = await refreshGranolaSession(session, this.options.fetchImpl);
-			this.#session = refreshedSession;
-			await this.store.writeSession(refreshedSession);
-			return;
-		} catch {
-			if (!this.options.source) {
-				this.#session = void 0;
-				await this.store.clearSession();
-				throw new Error("failed to refresh stored Granola session");
-			}
+}
+function parseRule(value) {
+	if (!value || typeof value !== "object" || Array.isArray(value)) return;
+	const record = value;
+	const id = typeof record.id === "string" && record.id.trim() ? record.id.trim() : void 0;
+	const name = typeof record.name === "string" && record.name.trim() ? record.name.trim() : void 0;
+	const whenValue = record.when && typeof record.when === "object" && !Array.isArray(record.when) ? record.when : void 0;
+	if (!id || !name || !whenValue) return;
+	return {
+		actions: Array.isArray(record.actions) ? record.actions.map((action, index) => parseAction(action, index)).filter((action) => Boolean(action)) : void 0,
+		enabled: typeof record.enabled === "boolean" ? record.enabled : void 0,
+		id,
+		name,
+		when: {
+			eventKinds: stringArray(whenValue.eventKinds),
+			folderIds: stringArray(whenValue.folderIds),
+			folderNames: stringArray(whenValue.folderNames),
+			meetingIds: stringArray(whenValue.meetingIds),
+			tags: stringArray(whenValue.tags),
+			titleIncludes: stringArray(whenValue.titleIncludes),
+			titleMatches: typeof whenValue.titleMatches === "string" && whenValue.titleMatches.trim() ? whenValue.titleMatches.trim() : void 0,
+			transcriptLoaded: typeof whenValue.transcriptLoaded === "boolean" ? whenValue.transcriptLoaded : void 0
 		}
-		if (this.options.source) {
-			const sourcedSession = await this.options.source.loadSession();
-			this.#session = sourcedSession;
-			await this.store.writeSession(sourcedSession);
-			return;
+	};
+}
+var FileAutomationRuleStore = class {
+	constructor(filePath = defaultAutomationRulesFilePath()) {
+		this.filePath = filePath;
+	}
+	async readRules() {
+		try {
+			const parsed = parseJsonString(await readFile(this.filePath, "utf8"));
+			return (Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.rules) ? parsed.rules : []).map((rule) => parseRule(rule)).filter((rule) => Boolean(rule)).map(cloneRule);
+		} catch {
+			return [];
 		}
-		this.#session = void 0;
-		await this.store.clearSession();
 	}
 };
-async function refreshGranolaSession(session, fetchImpl = fetch) {
-	if (!session.refreshToken?.trim()) throw new Error("refresh token not available");
-	const response = await fetchImpl(WORKOS_AUTH_URL, {
-		body: JSON.stringify({
-			client_id: session.clientId,
-			grant_type: "refresh_token",
-			refresh_token: session.refreshToken
-		}),
-		headers: { "Content-Type": "application/json" },
-		method: "POST"
-	});
-	if (!response.ok) throw new Error(`failed to refresh session: ${response.status} ${response.statusText}`);
-	const refreshed = parseSessionRecord(await response.json());
-	if (!refreshed) throw new Error("failed to parse refreshed session");
-	return {
-		...session,
-		...refreshed,
-		clientId: refreshed.clientId || session.clientId,
-		obtainedAt: refreshed.obtainedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
-		refreshToken: refreshed.refreshToken ?? session.refreshToken
-	};
+function defaultAutomationRulesFilePath() {
+	return defaultGranolaToolkitPersistenceLayout().automationRulesFile;
 }
-function defaultSessionFilePath() {
-	return defaultGranolaToolkitPersistenceLayout().sessionFile;
+function includesIgnoreCase(candidate, values) {
+	const lowerCandidate = candidate.toLowerCase();
+	return values.some((value) => lowerCandidate.includes(value.toLowerCase()));
 }
-function defaultApiKeyFilePath() {
-	return defaultGranolaToolkitPersistenceLayout().apiKeyFile;
+function matchesRule(rule, event) {
+	if (rule.enabled === false) return false;
+	const { when } = rule;
+	if (when.eventKinds?.length && !when.eventKinds.includes(event.kind)) return false;
+	if (when.meetingIds?.length && !when.meetingIds.includes(event.meetingId)) return false;
+	if (when.folderIds?.length && !event.folders.some((folder) => when.folderIds?.includes(folder.id))) return false;
+	if (when.folderNames?.length && !event.folders.some((folder) => when.folderNames?.includes(folder.name))) return false;
+	if (when.tags?.length && !event.tags.some((tag) => when.tags?.includes(tag))) return false;
+	if (when.titleIncludes?.length && !includesIgnoreCase(event.title, when.titleIncludes)) return false;
+	if (when.titleMatches) try {
+		if (!new RegExp(when.titleMatches, "i").test(event.title)) return false;
+	} catch {
+		return false;
+	}
+	if (typeof when.transcriptLoaded === "boolean" && when.transcriptLoaded !== event.transcriptLoaded) return false;
+	return true;
 }
-function createDefaultSessionStore() {
-	return defaultGranolaToolkitPersistenceLayout().sessionStoreKind === "keychain" ? new KeychainSessionStore() : new FileSessionStore();
+function matchAutomationRules(rules, events, matchedAt) {
+	const matches = [];
+	for (const event of events) for (const rule of rules) {
+		if (!matchesRule(rule, event)) continue;
+		matches.push({
+			eventId: event.id,
+			eventKind: event.kind,
+			folders: event.folders.map((folder) => ({ ...folder })),
+			id: `${event.id}:${rule.id}`,
+			matchedAt,
+			meetingId: event.meetingId,
+			ruleId: rule.id,
+			ruleName: rule.name,
+			tags: [...event.tags],
+			title: event.title,
+			transcriptLoaded: event.transcriptLoaded
+		});
+	}
+	return matches;
 }
-function createDefaultApiKeyStore() {
-	return defaultGranolaToolkitPersistenceLayout().sessionStoreKind === "keychain" ? new KeychainApiKeyStore() : new FileApiKeyStore();
+function createDefaultAutomationRuleStore(filePath) {
+	return new FileAutomationRuleStore(filePath);
+}
+//#endregion
+//#region src/cache.ts
+function parseCacheDocument(id, value) {
+	const record = asRecord(value);
+	if (!record) return;
+	return {
+		createdAt: stringValue(record.created_at),
+		id,
+		title: stringValue(record.title),
+		updatedAt: stringValue(record.updated_at)
+	};
+}
+function parseTranscriptSegments(value) {
+	if (!Array.isArray(value)) return;
+	return value.flatMap((segment) => {
+		const record = asRecord(segment);
+		if (!record) return [];
+		return [{
+			documentId: stringValue(record.document_id),
+			endTimestamp: stringValue(record.end_timestamp),
+			id: stringValue(record.id),
+			isFinal: Boolean(record.is_final),
+			source: stringValue(record.source),
+			startTimestamp: stringValue(record.start_timestamp),
+			text: stringValue(record.text)
+		}];
+	});
+}
+function parseCacheContents(contents) {
+	const outer = parseJsonString(contents);
+	if (!outer) throw new Error("failed to parse cache JSON");
+	const rawCache = outer.cache;
+	let cachePayload;
+	if (typeof rawCache === "string") cachePayload = parseJsonString(rawCache);
+	else cachePayload = asRecord(rawCache);
+	const state = cachePayload ? asRecord(cachePayload.state) : void 0;
+	if (!state) throw new Error("failed to parse cache state");
+	const rawDocuments = asRecord(state.documents) ?? {};
+	const rawTranscripts = asRecord(state.transcripts) ?? {};
+	const documents = {};
+	for (const [id, rawDocument] of Object.entries(rawDocuments)) {
+		const document = parseCacheDocument(id, rawDocument);
+		if (document) documents[id] = document;
+	}
+	const transcripts = {};
+	for (const [id, rawTranscript] of Object.entries(rawTranscripts)) {
+		const segments = parseTranscriptSegments(rawTranscript);
+		if (segments) transcripts[id] = segments;
+	}
+	return {
+		documents,
+		transcripts
+	};
 }
 //#endregion
 //#region src/client/default-auth.ts
@@ -3562,17 +4054,39 @@ function parseLastViewedPanel(value) {
 		updatedAt: stringValue(panel.updated_at)
 	};
 }
+function parseCalendarEvent(value) {
+	const record = asRecord(value);
+	if (!record) return;
+	const id = stringValue(record.id);
+	const recurringEventId = stringValue(record.recurring_event_id) || stringValue(record.recurringEventId);
+	const calendarId = stringValue(record.calendar_id) || stringValue(record.calendarId);
+	const url = stringValue(record.url);
+	const htmlLink = stringValue(record.html_link) || stringValue(record.htmlLink);
+	const startTime = stringValue(record.start_time) || stringValue(record.startTime);
+	const endTime = stringValue(record.end_time) || stringValue(record.endTime);
+	if (!id && !recurringEventId && !calendarId && !url && !htmlLink && !startTime && !endTime) return;
+	return {
+		calendarId: calendarId || void 0,
+		endTime: endTime || void 0,
+		htmlLink: htmlLink || void 0,
+		id: id || void 0,
+		recurringEventId: recurringEventId || void 0,
+		startTime: startTime || void 0,
+		url: url || void 0
+	};
+}
 function parseDocument(value) {
 	const record = asRecord(value);
 	if (!record) throw new Error("document payload is not an object");
 	return {
+		calendarEvent: parseCalendarEvent(record.google_calendar_event),
 		content: stringValue(record.content),
 		createdAt: stringValue(record.created_at),
 		id: stringValue(record.id),
 		lastViewedPanel: parseLastViewedPanel(record.last_viewed_panel),
 		notes: parseProseMirrorDoc(record.notes),
 		notesPlain: stringValue(record.notes_plain),
-		tags: stringArray$1(record.tags),
+		tags: stringArray$2(record.tags),
 		title: stringValue(record.title),
 		updatedAt: stringValue(record.updated_at)
 	};
@@ -3623,6 +4137,7 @@ function parsePublicNote(value) {
 	const summaryMarkdown = stringValue(record.summary_markdown);
 	const summaryText = stringValue(record.summary_text);
 	return {
+		calendarEvent: parseCalendarEvent(record.google_calendar_event),
 		content: summaryMarkdown || summaryText,
 		createdAt: stringValue(record.created_at),
 		folderMemberships: Array.isArray(record.folder_membership) ? record.folder_membership.map(parseFolderMembership).filter((membership) => Boolean(membership)) : [],
@@ -3829,97 +4344,6 @@ var GranolaPublicApiClient = class {
 	}
 };
 //#endregion
-//#region src/client/http.ts
-const RETRYABLE_STATUS_CODES = new Set([
-	429,
-	500,
-	502,
-	503,
-	504
-]);
-function sleep(delayMs) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, delayMs);
-	});
-}
-function parseRetryAfter(headerValue) {
-	if (!headerValue?.trim()) return;
-	if (/^\d+$/.test(headerValue.trim())) return Number(headerValue.trim()) * 1e3;
-	const retryAt = Date.parse(headerValue);
-	if (Number.isNaN(retryAt)) return;
-	return Math.max(0, retryAt - Date.now());
-}
-var AuthenticatedHttpClient = class {
-	fetchImpl;
-	constructor(options) {
-		this.fetchImpl = options.fetchImpl ?? fetch;
-		this.logger = options.logger;
-		this.maxRetries = options.maxRetries ?? 2;
-		this.retryBaseDelayMs = options.retryBaseDelayMs ?? 500;
-		this.retryMaxDelayMs = options.retryMaxDelayMs ?? 5e3;
-		this.sleepImpl = options.sleepImpl ?? sleep;
-		this.tokenProvider = options.tokenProvider;
-	}
-	logger;
-	maxRetries;
-	retryBaseDelayMs;
-	retryMaxDelayMs;
-	sleepImpl;
-	tokenProvider;
-	async retry(options, attempt, reason, response) {
-		const retryAfterMs = parseRetryAfter(response?.headers.get("retry-after") ?? null);
-		const delayMs = Math.min(retryAfterMs ?? this.retryBaseDelayMs * 2 ** attempt, this.retryMaxDelayMs);
-		this.logger?.warn?.(`${reason}; retrying in ${delayMs}ms (${attempt + 1}/${this.maxRetries})`);
-		await this.sleepImpl(delayMs);
-		return this.request(options, attempt + 1);
-	}
-	async request(options, attempt = 0) {
-		const { retryOnUnauthorized = true, timeoutMs, url } = options;
-		const accessToken = await this.tokenProvider.getAccessToken();
-		let response;
-		try {
-			response = await this.fetchImpl(url, {
-				body: options.body,
-				headers: {
-					...options.headers,
-					Authorization: `Bearer ${accessToken}`
-				},
-				method: options.method ?? "GET",
-				signal: AbortSignal.timeout(timeoutMs)
-			});
-		} catch (error) {
-			if (attempt < this.maxRetries) {
-				const message = error instanceof Error ? error.message : String(error);
-				return this.retry(options, attempt, `request failed: ${message}`);
-			}
-			throw error;
-		}
-		if (response.status === 401 && retryOnUnauthorized) {
-			this.logger?.warn?.("request returned 401; invalidating token provider and retrying once");
-			await this.tokenProvider.invalidate();
-			return this.request({
-				...options,
-				retryOnUnauthorized: false
-			}, attempt);
-		}
-		if (RETRYABLE_STATUS_CODES.has(response.status) && attempt < this.maxRetries) return this.retry(options, attempt, `request returned ${response.status} ${response.statusText || ""}`.trim(), response);
-		return response;
-	}
-	async postJson(url, body, options = { timeoutMs: 3e4 }) {
-		return this.request({
-			...options,
-			body: JSON.stringify(body),
-			headers: {
-				Accept: "*/*",
-				"Content-Type": "application/json",
-				...options.headers
-			},
-			method: "POST",
-			url
-		});
-	}
-};
-//#endregion
 //#region src/client/default.ts
 async function createDefaultGranolaRuntime(config, logger = console, options = {}) {
 	const auth = await inspectDefaultGranolaAuth(config, { preferredMode: options.preferredMode });
@@ -4628,6 +5052,62 @@ function cloneMeetingSummary(meeting) {
 		tags: [...meeting.tags]
 	};
 }
+function resolveActionFilePath(filePath, cwd) {
+	return cwd ? resolve(cwd, filePath) : resolve(filePath);
+}
+async function readOptionalActionFile(filePath, cwd) {
+	if (!filePath) return;
+	return await readFile(resolveActionFilePath(filePath, cwd), "utf8");
+}
+function combinePromptSections(...values) {
+	const sections = values.map((value) => value?.trim()).filter((value) => Boolean(value));
+	return sections.length > 0 ? sections.join("\n\n") : void 0;
+}
+function meetingTranscriptText(bundle) {
+	const segments = bundle.document.transcriptSegments ?? (bundle.cacheData ? bundle.cacheData.transcripts[bundle.document.id] : void 0);
+	if (!segments?.length) return;
+	return segments.slice().sort((left, right) => left.startTimestamp.localeCompare(right.startTimestamp)).map((segment) => segment.text.trim()).filter(Boolean).join("\n");
+}
+function buildAutomationAgentPrompt(match, rule, instructions, bundle) {
+	const transcriptText = bundle ? meetingTranscriptText(bundle)?.trim() : void 0;
+	const context = {
+		event: {
+			id: match.eventId,
+			kind: match.eventKind,
+			matchedAt: match.matchedAt,
+			meetingId: match.meetingId,
+			transcriptLoaded: match.transcriptLoaded
+		},
+		folders: match.folders.map((folder) => ({
+			id: folder.id,
+			name: folder.name
+		})),
+		meeting: bundle ? {
+			id: bundle.document.id,
+			notesPlain: bundle.document.notesPlain,
+			tags: [...bundle.document.tags],
+			title: bundle.document.title,
+			updatedAt: bundle.document.updatedAt
+		} : {
+			id: match.meetingId,
+			tags: [...match.tags],
+			title: match.title
+		},
+		rule: {
+			id: rule.id,
+			name: rule.name
+		}
+	};
+	return [
+		instructions.trim(),
+		"Meeting context (JSON):",
+		"```json",
+		JSON.stringify(context, null, 2),
+		"```",
+		bundle?.document.notesPlain?.trim() ? `Existing notes:\n${bundle.document.notesPlain.trim()}` : "",
+		transcriptText ? `Transcript:\n${transcriptText}` : ""
+	].filter(Boolean).join("\n\n");
+}
 function cloneState(state) {
 	return {
 		auth: { ...state.auth },
@@ -4636,6 +5116,7 @@ function cloneState(state) {
 		config: {
 			...state.config,
 			automation: state.config.automation ? { ...state.config.automation } : void 0,
+			agents: state.config.agents ? { ...state.config.agents } : void 0,
 			notes: { ...state.config.notes },
 			transcripts: { ...state.config.transcripts }
 		},
@@ -4673,6 +5154,7 @@ function defaultState(config, auth, surface) {
 		},
 		config: {
 			...config,
+			agents: config.agents ? { ...config.agents } : void 0,
 			notes: { ...config.notes },
 			transcripts: { ...config.transcripts }
 		},
@@ -4825,6 +5307,7 @@ var GranolaApp = class {
 			...rule,
 			actions: rule.actions?.map((action) => {
 				switch (action.kind) {
+					case "agent": return { ...action };
 					case "ask-user": return { ...action };
 					case "command": return {
 						...action,
@@ -5373,6 +5856,31 @@ var GranolaApp = class {
 			child.stdin.end();
 		});
 	}
+	async runAutomationAgent(match, rule, action) {
+		const bundle = match.eventKind === "meeting.removed" ? void 0 : await this.maybeReadMeetingBundleById(match.meetingId, { requireCache: false });
+		const harness = resolveAgentHarness(this.deps.agentHarnessStore ? await this.deps.agentHarnessStore.readHarnesses() : [], {
+			bundle,
+			match
+		}, action.harnessId);
+		const harnessCwd = harness?.cwd;
+		const promptFile = await readOptionalActionFile(action.promptFile, action.cwd ?? harnessCwd);
+		const harnessPromptFile = await readOptionalActionFile(harness?.promptFile, harnessCwd);
+		const systemPromptFile = await readOptionalActionFile(action.systemPromptFile, action.cwd ?? harnessCwd);
+		const harnessSystemPromptFile = await readOptionalActionFile(harness?.systemPromptFile, harnessCwd);
+		const instructions = combinePromptSections(harnessPromptFile, harness?.prompt, promptFile, action.prompt);
+		if (!instructions) throw new Error(`automation agent action ${action.id} is missing prompt instructions`);
+		const request = {
+			cwd: action.cwd ?? harnessCwd,
+			dryRun: action.dryRun,
+			model: action.model ?? harness?.model,
+			prompt: buildAutomationAgentPrompt(match, rule, instructions, bundle),
+			provider: action.provider ?? harness?.provider,
+			retries: action.retries,
+			systemPrompt: combinePromptSections(harnessSystemPromptFile, harness?.systemPrompt, systemPromptFile, action.systemPrompt),
+			timeoutMs: action.timeoutMs
+		};
+		return await (this.deps.agentRunner ?? createDefaultAutomationAgentRunner(this.config)).run(request);
+	}
 	async runAutomationActions(rules, matches) {
 		const rulesById = new Map(rules.map((rule) => [rule.id, rule]));
 		const existingRunIds = new Set(this.#automationActionRuns.map((run) => run.id));
@@ -5388,6 +5896,7 @@ var GranolaApp = class {
 					exportNotes: async (nextMatch, nextAction) => await this.runAutomationNotesAction(nextMatch, nextAction),
 					exportTranscripts: async (nextMatch, nextAction) => await this.runAutomationTranscriptAction(nextMatch, nextAction),
 					nowIso: () => this.nowIso(),
+					runAgent: async (nextMatch, nextRule, nextAction) => await this.runAutomationAgent(nextMatch, nextRule, nextAction),
 					runCommand: async (nextMatch, nextRule, nextAction) => await this.runAutomationCommand(nextMatch, nextRule, nextAction)
 				}));
 			}
@@ -5814,6 +6323,7 @@ async function createGranolaApp(config, options = {}) {
 	const automationRuns = await automationRunStore.readRuns({ limit: 0 });
 	const automationRuleStore = createDefaultAutomationRuleStore(config.automation?.rulesFile ?? defaultAutomationRulesFilePath());
 	const automationRules = await automationRuleStore.readRules();
+	const agentHarnessStore = createDefaultAgentHarnessStore(config.agents?.harnessesFile);
 	const authController = createDefaultGranolaAuthController(config);
 	const exportJobStore = createDefaultExportJobStore();
 	const exportJobs = await exportJobStore.readJobs();
@@ -5826,6 +6336,8 @@ async function createGranolaApp(config, options = {}) {
 	const syncState = await syncStateStore.readState();
 	return new GranolaApp(config, {
 		auth,
+		agentRunner: createDefaultAutomationAgentRunner(config),
+		agentHarnessStore,
 		authController,
 		automationMatches,
 		automationMatchStore,
@@ -5855,6 +6367,10 @@ function pickString(value) {
 function pickBoolean(value) {
 	return typeof value === "boolean" ? value : void 0;
 }
+function pickNumber(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string" && /^-?\d+$/.test(value.trim())) return Number(value.trim());
+}
 function parseTomlScalar(rawValue) {
 	const value = rawValue.trim();
 	if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) {
@@ -5907,9 +6423,24 @@ async function loadConfig(options) {
 	const configValues = config.values;
 	const defaultSupabase = firstExistingPath(granolaSupabaseCandidates());
 	const defaultCache = firstExistingPath(granolaCacheCandidates());
+	const agentTimeoutValue = pickString(env.GRANOLA_AGENT_TIMEOUT) ?? pickString(configValues["agent-timeout"]) ?? pickString(configValues.agentTimeout) ?? "5m";
 	const timeoutValue = pickString(options.subcommandFlags.timeout) ?? pickString(env.TIMEOUT) ?? pickString(configValues.timeout) ?? "2m";
 	return {
 		automation: { rulesFile: pickString(options.globalFlags.rules) ?? pickString(env.GRANOLA_AUTOMATION_RULES_FILE) ?? pickString(configValues["automation-rules-file"]) ?? pickString(configValues.automationRulesFile) ?? defaultGranolaToolkitPersistenceLayout().automationRulesFile },
+		agents: {
+			codexCommand: pickString(env.GRANOLA_CODEX_COMMAND) ?? pickString(configValues["codex-command"]) ?? pickString(configValues.codexCommand) ?? "codex",
+			defaultModel: pickString(env.GRANOLA_AGENT_MODEL) ?? pickString(configValues["agent-model"]) ?? pickString(configValues.agentModel),
+			defaultProvider: (() => {
+				const value = pickString(env.GRANOLA_AGENT_PROVIDER) ?? pickString(configValues["agent-provider"]) ?? pickString(configValues.agentProvider);
+				return value === "codex" || value === "openai" || value === "openrouter" ? value : void 0;
+			})(),
+			dryRun: envFlag(env.GRANOLA_AGENT_DRY_RUN) ?? pickBoolean(configValues["agent-dry-run"]) ?? pickBoolean(configValues.agentDryRun) ?? false,
+			harnessesFile: pickString(env.GRANOLA_AGENT_HARNESSES_FILE) ?? pickString(configValues["agent-harnesses-file"]) ?? pickString(configValues.agentHarnessesFile) ?? defaultGranolaToolkitPersistenceLayout().agentHarnessesFile,
+			maxRetries: pickNumber(env.GRANOLA_AGENT_MAX_RETRIES) ?? pickNumber(configValues["agent-max-retries"]) ?? pickNumber(configValues.agentMaxRetries) ?? 2,
+			openaiBaseUrl: pickString(env.GRANOLA_OPENAI_BASE_URL) ?? pickString(env.OPENAI_BASE_URL) ?? pickString(configValues["openai-base-url"]) ?? pickString(configValues.openaiBaseUrl) ?? "https://api.openai.com/v1",
+			openrouterBaseUrl: pickString(env.GRANOLA_OPENROUTER_BASE_URL) ?? pickString(env.OPENROUTER_BASE_URL) ?? pickString(configValues["openrouter-base-url"]) ?? pickString(configValues.openrouterBaseUrl) ?? "https://openrouter.ai/api/v1",
+			timeoutMs: parseDuration(agentTimeoutValue)
+		},
 		apiKey: pickString(options.globalFlags["api-key"]) ?? pickString(env.GRANOLA_API_KEY) ?? pickString(configValues["api-key"]) ?? pickString(configValues.apiKey),
 		configFileUsed: config.path,
 		debug: pickBoolean(options.globalFlags.debug) ?? envFlag(env.DEBUG_MODE) ?? pickBoolean(configValues.debug) ?? false,