openwork-server 0.18.60 → 0.18.62

package/README.md

@@ -9,7 +9,7 @@ npm install -g openwork-server
 openwork-server --workspace /path/to/workspace --approval auto
 ```
 
-The npm package runs on Node.js 22.13 or newer on macOS, Linux, and Windows (arm64 or x64); Bun is not required at runtime.
+The npm package requires stable Node.js 24.x, version 24.22.1 or newer within that major, on macOS, Linux, and Windows (arm64 or x64); Bun is not required at runtime. Older Node releases and other majors (including 25+) are rejected by the runtime gate. This security baseline also replaces the previous Node.js 22.13 minimum.
 
 ### Self-hosted web UI
 
@@ -34,8 +34,14 @@ persisted in `~/.openwork/openwork-server/web-tokens.json` so they survive
 restarts; `--token`/`--host-token` or `OPENWORK_TOKEN`/`OPENWORK_HOST_TOKEN`
 override them.
 
+In `web` mode the UI's pages never carry CORS headers, and the server only
+answers requests addressed to `localhost`, an IP address or the `--host` name.
+Add other names with `--allowed-hosts` (or `OPENWORK_ALLOWED_HOSTS`,
+comma-separated; `*` allows any).
+
 To reach it from other machines, keep the server on `127.0.0.1` and put a TLS
-proxy in front (e.g. `tailscale serve --bg --https=8787 http://127.0.0.1:8787`).
+proxy in front (e.g. `tailscale serve --bg --https=8787 http://127.0.0.1:8787`),
+then allow the proxy's name (e.g. `--allowed-hosts my-machine.tailnet.ts.net`).
 Browsers require a secure context for the UI on any non-localhost origin.
 Set `OPENWORK_OPENCODE_BIN` to use your own OpenCode install instead of the
 managed download; `/health` reports both the pinned `opencodeVersion` and the
@@ -175,6 +181,7 @@ Defaults to `~/.config/openwork/server.json` (override with `OPENWORK_SERVER_CON
 - `OPENWORK_APPROVAL_TIMEOUT_MS`
 - `OPENWORK_WORKSPACES` (JSON array or comma-separated list of paths)
 - `OPENWORK_CORS_ORIGINS` (comma-separated list or `*`)
+- `OPENWORK_ALLOWED_HOSTS` (comma-separated host names or `*`; `web` mode always checks the Host)
 - `OPENWORK_OPENCODE_BASE_URL`
 - `OPENWORK_OPENCODE_DIRECTORY`
 - `OPENWORK_OPENCODE_USERNAME`

package/bin/openwork-server.mjs

@@ -29,7 +29,7 @@ const nodeBundle = fromPackage("./dist/openwork-server.mjs");
 if (existsSync(nodeBundle)) {
   if (!nodeVersionSupported(process.versions.node)) {
     console.error(
-      `openwork-server needs Node.js ${MIN_NODE_VERSION} or newer (found ${process.versions.node}). Install a current Node.js LTS and try again.`,
+      `openwork-server needs Node.js 24.x, version ${MIN_NODE_VERSION} or newer within that major (found ${process.versions.node}). Install a supported Node.js 24 release and try again.`,
     );
     process.exit(1);
   }

package/bin/platform.mjs

@@ -16,13 +16,13 @@ export function serverBinaryName(platform, arch) {
   return `openwork-server-${target.target}${platform === "win32" ? ".exe" : ""}`;
 }
 
-// node:sqlite (the server's runtime database) is available without a flag
-// from Node 22.13 and 23.4.
-export const MIN_NODE_VERSION = "22.13.0";
+// Security baseline: only patched releases on the supported Node 24 line.
+// New majors must be reviewed explicitly, not accepted by a lower-bound check.
+export const MIN_NODE_VERSION = "24.22.1";
 
 export function nodeVersionSupported(version) {
-  const [major, minor] = version.replace(/^v/, "").split(".").map(Number);
-  if (major === 22) return minor >= 13;
-  if (major === 23) return minor >= 4;
-  return major > 23;
+  const match = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/.exec(version);
+  if (!match) return false;
+  const [, major, minor, patch] = match.map(Number);
+  return major === 24 && (minor > 22 || (minor === 22 && patch >= 1));
 }

package/dist/opencode-plugins/drive-file-tools.js

@@ -1,13 +1,15 @@
 import { z } from "zod";
 // The host performs these actions for its signed-in caller, as with drive_upload_file. Agents use these tools, which ask before writes.
 export const DRIVE_FILE_ACTIONS = ["drive_pull_file", "drive_file_status", "drive_push_file"];
-const connectionId = z.string().regex(/^(google-workspace|emc_[A-Za-z0-9]+)$/).optional()
-    .describe("Selected Google Workspace connection; omit for the default. Unavailable selections never fall back to another account.");
+const connectionId = z.string().regex(/^(google-workspace|microsoft-365|emc_[A-Za-z0-9]+)$/).optional()
+    .describe("Selected Google Workspace or Microsoft 365 connection; omit for the default. Unavailable selections never fall back to another account.");
 const workspacePath = z.string().min(1).max(4096);
 export const drivePullFileArgs = z.object({
-    fileId: z.string().min(1).max(2048).describe("Drive file ID or link."),
+    fileId: z.string().min(1).max(2048).describe("Google Drive file ID or link, or a OneDrive, SharePoint or Teams file link or item id."),
+    driveId: z.string().min(1).max(512).optional().describe("Microsoft 365 only: the driveId that came with the item id from a search or folder listing."),
+    provider: z.enum(["google-workspace", "microsoft-365"]).optional().describe("Only needed for a Microsoft item id without driveId; links and driveId identify Microsoft 365 files."),
     path: workspacePath.optional().describe("Workspace path to save to. Defaults to drive/<file name>."),
-    format: z.string().regex(/^[a-z]{2,5}$/).optional().describe("Docs, Sheets, Slides and Drawings only: xlsx, csv (first tab only), docx, md, txt, pptx, pdf, png or svg."),
+    format: z.string().regex(/^[a-z]{2,5}$/).optional().describe("Docs, Sheets, Slides and Drawings: xlsx, csv (first tab only), docx, md, txt, pptx, pdf, png or svg. OneDrive and SharePoint: pdf converts an Office file."),
     connectionId,
     overwrite: z.boolean().optional().describe("Replace a local copy even if it has edits not in Drive. Asks the person first."),
 }).strict();
@@ -16,7 +18,7 @@ export const driveFileStatusArgs = z.object({
 }).strict();
 export const drivePushFileArgs = z.object({
     path: workspacePath.describe("Workspace path of a pulled file."),
-    mode: z.enum(["replace", "copy"]).optional().describe("replace (default for stored files) updates the same Drive file; copy saves a new file next to it."),
+    mode: z.enum(["replace", "copy"]).optional().describe("replace (default for stored files) updates the same file; copy saves a new file next to it."),
     name: z.string().min(1).max(255).optional().describe("Name for a copy."),
 }).strict();
 function isRecord(value) {
@@ -33,7 +35,7 @@ async function askPermission(context, permission, patterns, metadata) {
 export function createDriveFileTools(call) {
     return {
         drive_pull_file: {
-            description: "Save a Google Drive file into the workspace and return its path and revision, never its content. Use it to analyze or edit Office, PDF, CSV or any large file with shell tools. Docs, Sheets and Slides arrive as docx, xlsx and pptx unless format says otherwise.",
+            description: "Save a Google Drive, OneDrive or SharePoint file into the workspace and return its path and revision, never its content. Use it to analyze or edit Office, PDF, CSV or any large file with shell tools. Docs, Sheets and Slides arrive as docx, xlsx and pptx unless format says otherwise.",
             args: drivePullFileArgs.shape,
             async execute(rawArgs, context) {
                 const args = drivePullFileArgs.parse(rawArgs ?? {});
@@ -43,14 +45,14 @@ export function createDriveFileTools(call) {
             },
         },
         drive_file_status: {
-            description: "For files pulled with drive_pull_file, report whether the local copy has edits not saved to Drive and whether the file changed in Drive since the pull.",
+            description: "For files pulled with drive_pull_file, report whether the local copy has edits not saved back and whether the file changed in Drive, OneDrive or SharePoint since the pull.",
             args: driveFileStatusArgs.shape,
             async execute(rawArgs, context) {
                 return JSON.stringify(await call("drive_file_status", driveFileStatusArgs.parse(rawArgs ?? {}), context), null, 2);
             },
         },
         drive_push_file: {
-            description: "Save a pulled file back to Google Drive when the person asks. Asks the person first. Stored files are replaced in place as a new Drive version; Docs, Sheets and Slides are saved as a new Google file next to the original. Returns drive_conflict, and changes nothing, when someone changed the file in Drive since the pull: pull it again and reapply the edits, or save a copy.",
+            description: "Save a pulled file back to where it came from when the person asks. Asks the person first. Stored files, including Office files in OneDrive and SharePoint, are replaced in place as a new version; Google Docs, Sheets and Slides and PDF conversions are saved as a new file next to the original. Returns drive_conflict, and changes nothing, when someone changed the file since the pull: pull it again and reapply the edits, or save a copy.",
             args: drivePushFileArgs.shape,
             async execute(rawArgs, context) {
                 const args = drivePushFileArgs.parse(rawArgs ?? {});

package/dist/opencode-plugins/openwork-cloud-skills-v2.js

@@ -19,6 +19,9 @@ const MAX_SKILLS = 150;
 const NATIVE_BUDGET_CHARS = 64_000;
 const NATIVE_DESCRIPTION_CHARS = 1_024;
 const MAX_MENTIONED_SKILLS = 3;
+// Bodies kept for the skills messages used most recently, so using one again
+// needs no read before the model runs. Every other skill loads on use.
+const MAX_WARM_SKILLS = 8;
 const skillId = (skill) => `${CLOUD_SKILL_ID_PREFIX}${skill.name}`;
 // Not SKILL.md: the native skill tool must not scan a fake directory. The engine
 // requires path and disables this whole plugin, OpenWork's context tools
@@ -60,10 +63,10 @@ function budgeted(skills, budget, descriptionChars, content) {
     return result;
 }
 /**
- * Each organization skill is a native skill
- * with its full description and its authorized SKILL.md, verified against the
- * digest Den published. A skill whose body could not be read or verified keeps
- * the discovery note, so it still works through get_skill.
+ * Each organization skill is a native skill with its full description. A
+ * skill whose authorized SKILL.md has been read for a message, verified against
+ * the digest Den published, carries it; every other skill keeps the discovery
+ * note, so it still works through get_skill.
  */
 export function nativeSkills(catalog, contents) {
     return budgeted(catalog.skills, NATIVE_BUDGET_CHARS, NATIVE_DESCRIPTION_CHARS, skill => {
@@ -113,15 +116,19 @@ export function mentionedSkillIds(text, skills) {
 }
 /** Setup starts background discovery without making Cloud a dependency of
  * chatting or local skill discovery. Only authorized catalog entries and
- * digest-verified bodies are added to the native registry. */
+ * digest-verified bodies are added to the native registry. Discovery reads
+ * metadata only; a body is read when a message names or attaches its skill. */
 export async function registerCloudSkillDiscovery(context) {
     let skills = [];
+    let catalog = { skills: [] };
     let fingerprint = "[]";
     let closed = false;
     let refreshing = false;
-    // Verified SKILL.md bodies by digest, in memory only. A body is re-read only
-    // when Den publishes a new digest, and dropped as soon as Den stops listing it.
+    // Verified SKILL.md bodies by digest, in memory only, for the warm skills.
+    // A body is re-read only when Den publishes a new digest for one of them.
     const contents = new Map();
+    // Skill IDs messages used, most recent last.
+    const warm = [];
     const controller = new AbortController();
     let registration;
     let promptHook;
@@ -134,44 +141,34 @@ export async function registerCloudSkillDiscovery(context) {
         });
         return response.ok ? await response.json() : null;
     };
-    const loadContents = async (catalog) => {
-        const wanted = new Set(catalog.skills.flatMap(skill => skill.digest && !skill.setup ? [skill.digest] : []));
-        for (const digest of contents.keys())
-            if (!wanted.has(digest))
-                contents.delete(digest);
-        for (const skill of catalog.skills) {
-            if (closed || !skill.digest || !skill.url || skill.setup || contents.has(skill.digest))
-                continue;
-            const result = z.object({ content: z.string() }).safeParse(await call("openwork_skill_read", { url: skill.url }).catch(() => null));
+    /** Read listed skills' bodies in one request and keep those matching Den's digest. */
+    const readBodies = async (entries, use) => {
+        const loadable = entries.filter(skill => skill.url && skill.digest && !skill.setup);
+        if (loadable.length === 0)
+            return;
+        const result = z.object({ contents: z.record(z.string(), z.string()) })
+            .safeParse(await call("openwork_skill_read", { urls: loadable.map(skill => skill.url), ...(use ? { use } : {}) }).catch(() => null));
+        if (!result.success)
+            return;
+        for (const skill of loadable) {
+            const body = result.data.contents[skill.url];
             // Only a body that matches Den's published digest is used.
-            if (result.success && sha256Digest(result.data.content) === skill.digest)
-                contents.set(skill.digest, result.data.content);
+            if (body !== undefined && sha256Digest(body) === skill.digest)
+                contents.set(skill.digest, body);
         }
     };
-    const ensurePromptHook = async () => {
-        if (promptHook || !context.session)
-            return;
-        promptHook = await context.session.hook("prompt", event => {
-            if (skills.length === 0)
-                return;
-            const attached = new Set((event.prompt.skills ?? []).map(skill => skill.id));
-            const mentioned = mentionedSkillIds(event.prompt.text, skills).filter(id => !attached.has(id));
-            if (mentioned.length === 0)
-                return;
-            event.prompt.skills = [...(event.prompt.skills ?? []), ...mentioned.map(id => ({ id }))];
-        });
+    const warmEntries = () => {
+        const listed = new Set(nativeSkills(catalog, contents).map(skill => skill.id));
+        return catalog.skills.filter(skill => warm.includes(skillId(skill)) && listed.has(skillId(skill)));
     };
-    const refresh = async () => {
-        if (closed || refreshing)
-            return;
-        refreshing = true;
-        try {
-            const value = await call("openwork_skills", {});
-            if (value === null)
-                return;
-            const catalog = catalogSchema.parse(value);
-            await loadContents(catalog);
-            await ensurePromptHook();
+    // Registry updates run one at a time, from refreshes and prompts alike.
+    let publishing = Promise.resolve();
+    const publish = () => {
+        publishing = publishing.catch(() => { }).then(async () => {
+            const wanted = new Set(warmEntries().flatMap(skill => skill.digest && !skill.setup ? [skill.digest] : []));
+            for (const digest of contents.keys())
+                if (!wanted.has(digest))
+                    contents.delete(digest);
             const next = nativeSkills(catalog, contents);
             const key = JSON.stringify(next);
             if (closed || key === fingerprint)
@@ -198,6 +195,54 @@ export async function registerCloudSkillDiscovery(context) {
                 await context.skill.reload();
             }
             fingerprint = key;
+        });
+        return publishing;
+    };
+    const ensurePromptHook = async () => {
+        if (promptHook || !context.session)
+            return;
+        promptHook = await context.session.hook("prompt", async (event) => {
+            if (skills.length === 0)
+                return;
+            const attached = new Set((event.prompt.skills ?? []).map(skill => skill.id));
+            const mentioned = mentionedSkillIds(event.prompt.text, skills).filter(id => !attached.has(id));
+            if (mentioned.length)
+                event.prompt.skills = [...(event.prompt.skills ?? []), ...mentioned.map(id => ({ id }))];
+            // Only registered skills: an unlisted ID never costs a read.
+            const registered = new Set(skills.map(skill => skill.id));
+            const used = new Set([...attached, ...mentioned].filter(id => registered.has(id)));
+            const entries = catalog.skills.filter(skill => used.has(skillId(skill)));
+            if (entries.length === 0)
+                return;
+            try {
+                // Freshly authorized for this message, and counted by Den as a use.
+                // A body that cannot be read leaves the discovery note: get_skill still works.
+                await readBodies(entries, true);
+                for (const skill of entries) {
+                    const id = skillId(skill);
+                    warm.splice(0, warm.length, ...warm.filter(entry => entry !== id), id);
+                }
+                warm.splice(0, Math.max(0, warm.length - MAX_WARM_SKILLS));
+                await publish();
+            }
+            catch {
+                // A message is never held back by Cloud skill loading.
+            }
+        });
+    };
+    const refresh = async () => {
+        if (closed || refreshing)
+            return;
+        refreshing = true;
+        try {
+            const value = await call("openwork_skills", {});
+            if (value === null)
+                return;
+            catalog = catalogSchema.parse(value);
+            // Only warm skills whose digest changed are read again.
+            await readBodies(warmEntries().filter(skill => skill.digest && !contents.has(skill.digest)), false);
+            await ensurePromptHook();
+            await publish();
         }
         catch {
             // Cloud readiness is never a prerequisite to chatting. Discovery entries
@@ -216,6 +261,7 @@ export async function registerCloudSkillDiscovery(context) {
         controller.abort();
         skills = [];
         contents.clear();
+        await publishing.catch(() => { });
         await promptHook?.dispose();
         await registration?.dispose();
     };

package/dist/opencode-plugins/openwork-context-v2.js

@@ -13813,6 +13813,7 @@ var MAX_SKILLS = 150;
 var NATIVE_BUDGET_CHARS = 64000;
 var NATIVE_DESCRIPTION_CHARS = 1024;
 var MAX_MENTIONED_SKILLS = 3;
+var MAX_WARM_SKILLS = 8;
 var skillId = (skill) => `${CLOUD_SKILL_ID_PREFIX}${skill.name}`;
 var skillPath = (skill) => `/openwork/remote-skills/${skill.name}.md`;
 function discoveryContent(skill) {
@@ -13890,10 +13891,12 @@ function mentionedSkillIds(text2, skills) {
 }
 async function registerCloudSkillDiscovery(context) {
   let skills = [];
+  let catalog = { skills: [] };
   let fingerprint = "[]";
   let closed = false;
   let refreshing = false;
   const contents = new Map;
+  const warm = [];
   const controller = new AbortController;
   let registration;
   let promptHook;
@@ -13907,43 +13910,30 @@ async function registerCloudSkillDiscovery(context) {
     });
     return response.ok ? await response.json() : null;
   };
-  const loadContents = async (catalog) => {
-    const wanted = new Set(catalog.skills.flatMap((skill) => skill.digest && !skill.setup ? [skill.digest] : []));
-    for (const digest of contents.keys())
-      if (!wanted.has(digest))
-        contents.delete(digest);
-    for (const skill of catalog.skills) {
-      if (closed || !skill.digest || !skill.url || skill.setup || contents.has(skill.digest))
-        continue;
-      const result = exports_external.object({ content: exports_external.string() }).safeParse(await call("openwork_skill_read", { url: skill.url }).catch(() => null));
-      if (result.success && sha256Digest(result.data.content) === skill.digest)
-        contents.set(skill.digest, result.data.content);
-    }
-  };
-  const ensurePromptHook = async () => {
-    if (promptHook || !context.session)
+  const readBodies = async (entries, use) => {
+    const loadable = entries.filter((skill) => skill.url && skill.digest && !skill.setup);
+    if (loadable.length === 0)
       return;
-    promptHook = await context.session.hook("prompt", (event) => {
-      if (skills.length === 0)
-        return;
-      const attached = new Set((event.prompt.skills ?? []).map((skill) => skill.id));
-      const mentioned = mentionedSkillIds(event.prompt.text, skills).filter((id) => !attached.has(id));
-      if (mentioned.length === 0)
-        return;
-      event.prompt.skills = [...event.prompt.skills ?? [], ...mentioned.map((id) => ({ id }))];
-    });
-  };
-  const refresh = async () => {
-    if (closed || refreshing)
+    const result = exports_external.object({ contents: exports_external.record(exports_external.string(), exports_external.string()) }).safeParse(await call("openwork_skill_read", { urls: loadable.map((skill) => skill.url), ...use ? { use } : {} }).catch(() => null));
+    if (!result.success)
       return;
-    refreshing = true;
-    try {
-      const value = await call("openwork_skills", {});
-      if (value === null)
-        return;
-      const catalog = catalogSchema.parse(value);
-      await loadContents(catalog);
-      await ensurePromptHook();
+    for (const skill of loadable) {
+      const body = result.data.contents[skill.url];
+      if (body !== undefined && sha256Digest(body) === skill.digest)
+        contents.set(skill.digest, body);
+    }
+  };
+  const warmEntries = () => {
+    const listed = new Set(nativeSkills(catalog, contents).map((skill) => skill.id));
+    return catalog.skills.filter((skill) => warm.includes(skillId(skill)) && listed.has(skillId(skill)));
+  };
+  let publishing = Promise.resolve();
+  const publish = () => {
+    publishing = publishing.catch(() => {}).then(async () => {
+      const wanted = new Set(warmEntries().flatMap((skill) => skill.digest && !skill.setup ? [skill.digest] : []));
+      for (const digest of contents.keys())
+        if (!wanted.has(digest))
+          contents.delete(digest);
       const next = nativeSkills(catalog, contents);
       const key = JSON.stringify(next);
       if (closed || key === fingerprint)
@@ -13968,6 +13958,47 @@ async function registerCloudSkillDiscovery(context) {
         await context.skill.reload();
       }
       fingerprint = key;
+    });
+    return publishing;
+  };
+  const ensurePromptHook = async () => {
+    if (promptHook || !context.session)
+      return;
+    promptHook = await context.session.hook("prompt", async (event) => {
+      if (skills.length === 0)
+        return;
+      const attached = new Set((event.prompt.skills ?? []).map((skill) => skill.id));
+      const mentioned = mentionedSkillIds(event.prompt.text, skills).filter((id) => !attached.has(id));
+      if (mentioned.length)
+        event.prompt.skills = [...event.prompt.skills ?? [], ...mentioned.map((id) => ({ id }))];
+      const registered = new Set(skills.map((skill) => skill.id));
+      const used = new Set([...attached, ...mentioned].filter((id) => registered.has(id)));
+      const entries = catalog.skills.filter((skill) => used.has(skillId(skill)));
+      if (entries.length === 0)
+        return;
+      try {
+        await readBodies(entries, true);
+        for (const skill of entries) {
+          const id = skillId(skill);
+          warm.splice(0, warm.length, ...warm.filter((entry) => entry !== id), id);
+        }
+        warm.splice(0, Math.max(0, warm.length - MAX_WARM_SKILLS));
+        await publish();
+      } catch {}
+    });
+  };
+  const refresh = async () => {
+    if (closed || refreshing)
+      return;
+    refreshing = true;
+    try {
+      const value = await call("openwork_skills", {});
+      if (value === null)
+        return;
+      catalog = catalogSchema.parse(value);
+      await readBodies(warmEntries().filter((skill) => skill.digest && !contents.has(skill.digest)), false);
+      await ensurePromptHook();
+      await publish();
     } catch {} finally {
       refreshing = false;
     }
@@ -13981,6 +14012,7 @@ async function registerCloudSkillDiscovery(context) {
     controller.abort();
     skills = [];
     contents.clear();
+    await publishing.catch(() => {});
     await promptHook?.dispose();
     await registration?.dispose();
   };

package/dist/opencode-plugins/openwork-extensions-preview.js

@@ -13873,12 +13873,14 @@ async function uiBridgeRequest(path, options = {}) {
 
 // src/opencode-plugins/drive-file-tools.ts
 var DRIVE_FILE_ACTIONS = ["drive_pull_file", "drive_file_status", "drive_push_file"];
-var connectionId = exports_external.string().regex(/^(google-workspace|emc_[A-Za-z0-9]+)$/).optional().describe("Selected Google Workspace connection; omit for the default. Unavailable selections never fall back to another account.");
+var connectionId = exports_external.string().regex(/^(google-workspace|microsoft-365|emc_[A-Za-z0-9]+)$/).optional().describe("Selected Google Workspace or Microsoft 365 connection; omit for the default. Unavailable selections never fall back to another account.");
 var workspacePath = exports_external.string().min(1).max(4096);
 var drivePullFileArgs = exports_external.object({
-  fileId: exports_external.string().min(1).max(2048).describe("Drive file ID or link."),
+  fileId: exports_external.string().min(1).max(2048).describe("Google Drive file ID or link, or a OneDrive, SharePoint or Teams file link or item id."),
+  driveId: exports_external.string().min(1).max(512).optional().describe("Microsoft 365 only: the driveId that came with the item id from a search or folder listing."),
+  provider: exports_external.enum(["google-workspace", "microsoft-365"]).optional().describe("Only needed for a Microsoft item id without driveId; links and driveId identify Microsoft 365 files."),
   path: workspacePath.optional().describe("Workspace path to save to. Defaults to drive/<file name>."),
-  format: exports_external.string().regex(/^[a-z]{2,5}$/).optional().describe("Docs, Sheets, Slides and Drawings only: xlsx, csv (first tab only), docx, md, txt, pptx, pdf, png or svg."),
+  format: exports_external.string().regex(/^[a-z]{2,5}$/).optional().describe("Docs, Sheets, Slides and Drawings: xlsx, csv (first tab only), docx, md, txt, pptx, pdf, png or svg. OneDrive and SharePoint: pdf converts an Office file."),
   connectionId,
   overwrite: exports_external.boolean().optional().describe("Replace a local copy even if it has edits not in Drive. Asks the person first.")
 }).strict();
@@ -13887,7 +13889,7 @@ var driveFileStatusArgs = exports_external.object({
 }).strict();
 var drivePushFileArgs = exports_external.object({
   path: workspacePath.describe("Workspace path of a pulled file."),
-  mode: exports_external.enum(["replace", "copy"]).optional().describe("replace (default for stored files) updates the same Drive file; copy saves a new file next to it."),
+  mode: exports_external.enum(["replace", "copy"]).optional().describe("replace (default for stored files) updates the same file; copy saves a new file next to it."),
   name: exports_external.string().min(1).max(255).optional().describe("Name for a copy.")
 }).strict();
 function isRecord2(value) {
@@ -13902,7 +13904,7 @@ async function askPermission(context, permission, patterns, metadata) {
 function createDriveFileTools(call) {
   return {
     drive_pull_file: {
-      description: "Save a Google Drive file into the workspace and return its path and revision, never its content. Use it to analyze or edit Office, PDF, CSV or any large file with shell tools. Docs, Sheets and Slides arrive as docx, xlsx and pptx unless format says otherwise.",
+      description: "Save a Google Drive, OneDrive or SharePoint file into the workspace and return its path and revision, never its content. Use it to analyze or edit Office, PDF, CSV or any large file with shell tools. Docs, Sheets and Slides arrive as docx, xlsx and pptx unless format says otherwise.",
       args: drivePullFileArgs.shape,
       async execute(rawArgs, context) {
         const args = drivePullFileArgs.parse(rawArgs ?? {});
@@ -13912,14 +13914,14 @@ function createDriveFileTools(call) {
       }
     },
     drive_file_status: {
-      description: "For files pulled with drive_pull_file, report whether the local copy has edits not saved to Drive and whether the file changed in Drive since the pull.",
+      description: "For files pulled with drive_pull_file, report whether the local copy has edits not saved back and whether the file changed in Drive, OneDrive or SharePoint since the pull.",
       args: driveFileStatusArgs.shape,
       async execute(rawArgs, context) {
         return JSON.stringify(await call("drive_file_status", driveFileStatusArgs.parse(rawArgs ?? {}), context), null, 2);
       }
     },
     drive_push_file: {
-      description: "Save a pulled file back to Google Drive when the person asks. Asks the person first. Stored files are replaced in place as a new Drive version; Docs, Sheets and Slides are saved as a new Google file next to the original. Returns drive_conflict, and changes nothing, when someone changed the file in Drive since the pull: pull it again and reapply the edits, or save a copy.",
+      description: "Save a pulled file back to where it came from when the person asks. Asks the person first. Stored files, including Office files in OneDrive and SharePoint, are replaced in place as a new version; Google Docs, Sheets and Slides and PDF conversions are saved as a new file next to the original. Returns drive_conflict, and changes nothing, when someone changed the file since the pull: pull it again and reapply the edits, or save a copy.",
       args: drivePushFileArgs.shape,
       async execute(rawArgs, context) {
         const args = drivePushFileArgs.parse(rawArgs ?? {});