runline 0.11.6 → 0.12.0

package/dist/plugins/gmail/src/index.js

@@ -616,6 +616,7 @@ export default function gmail(rl) {
     });
     // ── Message ───────────────────────────────────────────
     rl.registerAction("message.send", {
+        access: "write",
         description: "Send an email",
         inputSchema: {
             to: {
@@ -661,6 +662,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.reply", {
+        access: "write",
         description: "Reply to a message, preserving threadId and In-Reply-To/References headers",
         inputSchema: {
             messageId: { type: "string", required: true },
@@ -678,6 +680,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.get", {
+        access: "read",
         description: "Get a message by ID",
         inputSchema: {
             id: { type: "string", required: true },
@@ -706,6 +709,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.list", {
+        access: "read",
         description: "List messages. Supports Gmail search syntax via `q`, plus friendly filters: sender, readStatus ('read'|'unread'), receivedAfter/Before (ISO string, ms, or seconds).",
         inputSchema: {
             q: { type: "string", required: false, description: "Gmail search query" },
@@ -743,6 +747,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.delete", {
+        access: "write",
         description: "Permanently delete a message",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -751,6 +756,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.trash", {
+        access: "write",
         description: "Move a message to trash (recoverable)",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -759,6 +765,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.untrash", {
+        access: "write",
         description: "Remove a message from trash",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -767,6 +774,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.markAsRead", {
+        access: "write",
         description: "Remove the UNREAD label",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -777,6 +785,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.markAsUnread", {
+        access: "write",
         description: "Add the UNREAD label",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -787,6 +796,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.addLabels", {
+        access: "write",
         description: "Add labels to a message",
         inputSchema: {
             id: { type: "string", required: true },
@@ -800,6 +810,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.removeLabels", {
+        access: "write",
         description: "Remove labels from a message",
         inputSchema: {
             id: { type: "string", required: true },
@@ -813,6 +824,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("message.getAttachment", {
+        access: "read",
         description: "Download an attachment by ID (returns {size, data} where data is base64url)",
         inputSchema: {
             messageId: { type: "string", required: true },
@@ -825,6 +837,7 @@ export default function gmail(rl) {
     });
     // ── Thread ────────────────────────────────────────────
     rl.registerAction("thread.get", {
+        access: "read",
         description: "Get a thread by ID",
         inputSchema: {
             id: { type: "string", required: true },
@@ -853,6 +866,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("thread.list", {
+        access: "read",
         description: "List threads. Same filter sugar as `message.list` (sender, readStatus, receivedAfter/Before).",
         inputSchema: {
             q: { type: "string", required: false },
@@ -877,6 +891,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("thread.delete", {
+        access: "write",
         description: "Permanently delete a thread",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -885,6 +900,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("thread.trash", {
+        access: "write",
         description: "Move a thread to trash",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -893,6 +909,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("thread.untrash", {
+        access: "write",
         description: "Remove a thread from trash",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -901,6 +918,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("thread.addLabels", {
+        access: "write",
         description: "Add labels to all messages in a thread",
         inputSchema: {
             id: { type: "string", required: true },
@@ -914,6 +932,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("thread.removeLabels", {
+        access: "write",
         description: "Remove labels from all messages in a thread",
         inputSchema: {
             id: { type: "string", required: true },
@@ -927,6 +946,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("thread.reply", {
+        access: "write",
         description: "Reply to the last message in a thread (convenience wrapper over message.reply)",
         inputSchema: {
             id: { type: "string", required: true, description: "Thread ID" },
@@ -950,6 +970,7 @@ export default function gmail(rl) {
     });
     // ── Draft ─────────────────────────────────────────────
     rl.registerAction("draft.create", {
+        access: "write",
         description: "Create a draft",
         inputSchema: {
             to: { type: "string", required: false },
@@ -1001,6 +1022,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("draft.get", {
+        access: "read",
         description: "Get a draft by ID",
         inputSchema: {
             id: { type: "string", required: true },
@@ -1013,6 +1035,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("draft.list", {
+        access: "read",
         description: "List drafts",
         inputSchema: {
             q: { type: "string", required: false },
@@ -1038,6 +1061,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("draft.delete", {
+        access: "write",
         description: "Delete a draft",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -1046,6 +1070,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("draft.send", {
+        access: "write",
         description: "Send an existing draft",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -1055,6 +1080,7 @@ export default function gmail(rl) {
     });
     // ── Label ─────────────────────────────────────────────
     rl.registerAction("label.create", {
+        access: "write",
         description: "Create a label",
         inputSchema: {
             name: { type: "string", required: true },
@@ -1082,6 +1108,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("label.get", {
+        access: "read",
         description: "Get a label by ID",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -1090,6 +1117,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("label.list", {
+        access: "read",
         description: "List all labels",
         async execute(_input, ctx) {
             const res = (await gmailRequest(ctx, "GET", "/labels"));
@@ -1097,6 +1125,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("label.delete", {
+        access: "write",
         description: "Delete a label",
         inputSchema: { id: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -1105,6 +1134,7 @@ export default function gmail(rl) {
         },
     });
     rl.registerAction("label.update", {
+        access: "write",
         description: "Update a label",
         inputSchema: {
             id: { type: "string", required: true },
@@ -1128,12 +1158,14 @@ export default function gmail(rl) {
     });
     // ── Profile / aliases ─────────────────────────────────
     rl.registerAction("profile.get", {
+        access: "read",
         description: "Get the authenticated user's profile",
         async execute(_input, ctx) {
             return gmailRequest(ctx, "GET", "/profile");
         },
     });
     rl.registerAction("alias.list", {
+        access: "read",
         description: "List configured send-as aliases",
         async execute(_input, ctx) {
             const res = (await gmailRequest(ctx, "GET", "/settings/sendAs"));

package/dist/plugins/gong/src/index.js

@@ -62,6 +62,7 @@ export default function gong(rl) {
         },
     });
     rl.registerAction("call.get", {
+        access: "read",
         description: "Get detailed call data",
         inputSchema: {
             callId: { type: "string", required: true, description: "Call ID" },
@@ -83,6 +84,7 @@ export default function gong(rl) {
         },
     });
     rl.registerAction("call.list", {
+        access: "read",
         description: "List calls",
         inputSchema: {
             limit: { type: "number", required: false, description: "Max results" },
@@ -130,6 +132,7 @@ export default function gong(rl) {
         },
     });
     rl.registerAction("user.get", {
+        access: "read",
         description: "Get a user",
         inputSchema: {
             userId: { type: "string", required: true, description: "User ID" },
@@ -145,6 +148,7 @@ export default function gong(rl) {
         },
     });
     rl.registerAction("user.list", {
+        access: "read",
         description: "List users",
         inputSchema: {
             limit: { type: "number", required: false, description: "Max results" },

package/dist/plugins/googleAppsScript/src/index.js

@@ -46,6 +46,7 @@ export default function googleAppsScript(rl) {
         serviceAccountSubject: { type: "string", required: false, description: "User to impersonate (domain-wide delegation)", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_SUBJECT" },
     });
     rl.registerAction("script.list", {
+        access: "read",
         description: "List Apps Script projects in Drive (standalone scripts; bound scripts live inside their container and don't appear here).",
         inputSchema: {
             query: { type: "string", required: false, description: "Case-insensitive name substring filter." },
@@ -68,6 +69,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("project.getContent", {
+        access: "read",
         description: "Get all files of an Apps Script project (name, type, source).",
         inputSchema: { scriptId: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -76,6 +78,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("project.readFile", {
+        access: "read",
         description: "Read one file's source from a project.",
         inputSchema: {
             scriptId: { type: "string", required: true },
@@ -90,6 +93,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("file.edit", {
+        access: "write",
         description: "Replace (or add) a single file's source, leaving other files untouched. Read-modify-write — the safe way to change code.",
         inputSchema: {
             scriptId: { type: "string", required: true },
@@ -112,6 +116,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("project.updateContent", {
+        access: "write",
         description: "Replace the entire project file set. files = [{name, type, source}], must include the appsscript JSON manifest. Prefer file.edit for single changes.",
         inputSchema: {
             scriptId: { type: "string", required: true },
@@ -123,6 +128,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("project.create", {
+        access: "write",
         description: "Create a new Apps Script project. Pass parentId (a Drive file id, e.g. a Sheet) to bind it to that container.",
         inputSchema: {
             title: { type: "string", required: true },
@@ -137,6 +143,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("version.create", {
+        access: "write",
         description: "Create an immutable version of the project (needed before deploying).",
         inputSchema: {
             scriptId: { type: "string", required: true },
@@ -148,6 +155,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("deployment.create", {
+        access: "write",
         description: "Deploy a version. For function.run, deploy with an API-executable manifest (executionApi access).",
         inputSchema: {
             scriptId: { type: "string", required: true },
@@ -165,6 +173,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("function.run", {
+        access: "write",
         description: "Run a function via scripts.run. Requires the project linked to a standard GCP project, the Apps Script API enabled, and an API-executable deployment (or devMode for the owner).",
         inputSchema: {
             scriptId: { type: "string", required: true },
@@ -186,6 +195,7 @@ export default function googleAppsScript(rl) {
         },
     });
     rl.registerAction("process.list", {
+        access: "read",
         description: "Recent executions for a project (status, function, times) — a log view.",
         inputSchema: {
             scriptId: { type: "string", required: true },

package/dist/plugins/googleCalendar/src/index.js

@@ -345,6 +345,7 @@ export default function googleCalendar(rl) {
     });
     // ── Calendar ──────────────────────────────────────────
     rl.registerAction("calendar.list", {
+        access: "read",
         description: "List calendars the authenticated user has access to",
         inputSchema: {
             returnAll: { type: "boolean", required: false },
@@ -377,6 +378,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("calendar.get", {
+        access: "read",
         description: "Get a calendar's metadata (including conference solutions)",
         inputSchema: {
             calendarId: {
@@ -391,6 +393,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("calendar.availability", {
+        access: "read",
         description: "Check free/busy information for one or more calendars over a time range",
         inputSchema: {
             calendarId: {
@@ -466,6 +469,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("calendar.listColors", {
+        access: "read",
         description: "List event and calendar color palettes available in Google Calendar",
         async execute(_input, ctx) {
             return calRequest(ctx, "GET", "/colors");
@@ -473,6 +477,7 @@ export default function googleCalendar(rl) {
     });
     // ── Event ─────────────────────────────────────────────
     rl.registerAction("event.create", {
+        access: "write",
         description: "Create a calendar event",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -550,6 +555,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("event.get", {
+        access: "read",
         description: "Get a single event",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -576,6 +582,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("event.list", {
+        access: "read",
         description: "List events in a calendar. Set `singleEvents=true` to expand recurring events into instances.",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -645,6 +652,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("event.listInstances", {
+        access: "read",
         description: "List instances of a recurring event",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -679,6 +687,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("event.update", {
+        access: "write",
         description: "Patch an event (only supplied fields are changed). Set modifyTarget='series' to edit the entire recurrence instead of a single instance.",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -748,6 +757,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("event.delete", {
+        access: "write",
         description: "Delete an event",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -763,6 +773,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("event.move", {
+        access: "write",
         description: "Move an event from one calendar to another",
         inputSchema: {
             calendarId: { type: "string", required: true, description: "Source calendar" },
@@ -782,6 +793,7 @@ export default function googleCalendar(rl) {
     });
     // ─── FreeBusy ────────────────────────────────────────────────────
     rl.registerAction("freeBusy.query", {
+        access: "read",
         description: "Query free/busy windows across one or more calendars in a time range. Returns an array of busy intervals per calendar id, plus any errors.",
         inputSchema: {
             calendarIds: { type: "array", required: true, description: "Calendar ids to query (use 'primary' for the user's own)." },
@@ -806,6 +818,7 @@ export default function googleCalendar(rl) {
     });
     // ─── Calendar list management ───────────────────────────────────
     rl.registerAction("calendarList.list", {
+        access: "read",
         description: "List calendars on the user's calendar list (the user's left sidebar).",
         inputSchema: {
             minAccessRole: { type: "string", required: false, description: "freeBusyReader | reader | writer | owner" },
@@ -828,6 +841,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("calendarList.insert", {
+        access: "write",
         description: "Add a calendar (by id) to the user's calendar list.",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -846,6 +860,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("calendarList.patch", {
+        access: "write",
         description: "Patch a calendar entry on the user's calendar list (colors, summary override, reminders, selected).",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -868,6 +883,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("calendarList.delete", {
+        access: "write",
         description: "Remove a calendar from the user's calendar list (does not delete the underlying calendar).",
         inputSchema: { calendarId: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -878,6 +894,7 @@ export default function googleCalendar(rl) {
     });
     // ─── ACL (calendar sharing) ──────────────────────────────────────
     rl.registerAction("acl.list", {
+        access: "read",
         description: "List ACL rules on a calendar.",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -893,6 +910,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("acl.insert", {
+        access: "write",
         description: "Add an ACL rule to a calendar. Roles: 'none' | 'freeBusyReader' | 'reader' | 'writer' | 'owner'.",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -908,6 +926,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("acl.update", {
+        access: "write",
         description: "Patch an ACL rule's role.",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -920,6 +939,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("acl.delete", {
+        access: "write",
         description: "Remove an ACL rule.",
         inputSchema: {
             calendarId: { type: "string", required: true },
@@ -933,6 +953,7 @@ export default function googleCalendar(rl) {
     });
     // ─── Settings ────────────────────────────────────────────────────
     rl.registerAction("settings.list", {
+        access: "read",
         description: "List the user's calendar settings (timezone, week start, working location, etc.).",
         inputSchema: { returnAll: { type: "boolean", required: false, default: true } },
         async execute(_input, ctx) {
@@ -940,6 +961,7 @@ export default function googleCalendar(rl) {
         },
     });
     rl.registerAction("settings.get", {
+        access: "read",
         description: "Get a single setting by key (e.g. 'timezone', 'weekStart', 'locale').",
         inputSchema: { setting: { type: "string", required: true } },
         async execute(input, ctx) {

package/dist/plugins/googleContacts/src/index.js

@@ -326,6 +326,7 @@ export default function googleContacts(rl) {
     });
     // ── Contact ───────────────────────────────────────────
     rl.registerAction("contact.create", {
+        access: "write",
         description: "Create a new contact",
         inputSchema: {
             givenName: { type: "string", required: false },
@@ -389,6 +390,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("contact.get", {
+        access: "read",
         description: "Get a contact by ID",
         inputSchema: {
             contactId: {
@@ -410,6 +412,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("contact.list", {
+        access: "read",
         description: "List contacts (people/me/connections) or search them. When `query` is set, hits people:searchContacts; otherwise returns the user's connections.",
         inputSchema: {
             query: {
@@ -479,6 +482,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("contact.update", {
+        access: "write",
         description: "Update a contact. Only supplied fields are sent; etag is resolved automatically if not provided.",
         inputSchema: {
             contactId: { type: "string", required: true },
@@ -533,6 +537,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("contact.delete", {
+        access: "write",
         description: "Delete a contact",
         inputSchema: { contactId: { type: "string", required: true } },
         async execute(input, ctx) {
@@ -544,6 +549,7 @@ export default function googleContacts(rl) {
     });
     // ── Contact groups ────────────────────────────────────
     rl.registerAction("group.list", {
+        access: "read",
         description: "List contact groups (including system groups like 'myContacts' and 'starred')",
         inputSchema: {
             returnAll: { type: "boolean", required: false },
@@ -567,6 +573,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("group.get", {
+        access: "read",
         description: "Get a contact group by ID",
         inputSchema: {
             groupId: { type: "string", required: true },
@@ -586,6 +593,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("group.create", {
+        access: "write",
         description: "Create a contact group",
         inputSchema: {
             name: { type: "string", required: true },
@@ -607,6 +615,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("group.update", {
+        access: "write",
         description: "Update a contact group. Pass a fresh `etag` or let the plugin resolve it automatically.",
         inputSchema: {
             groupId: { type: "string", required: true },
@@ -642,6 +651,7 @@ export default function googleContacts(rl) {
         },
     });
     rl.registerAction("group.delete", {
+        access: "write",
         description: "Delete a contact group. Pass `deleteContacts=true` to also delete every contact in the group.",
         inputSchema: {
             groupId: { type: "string", required: true },

package/dist/plugins/googleDocs/src/documents.js

@@ -1,6 +1,7 @@
 import { DRIVE_BASE, docsRequest, extractDocumentId, flattenBodyText, } from "./shared.js";
 export function registerDocumentsActions(rl) {
     rl.registerAction("document.create", {
+        access: "write",
         description: "Create a new Google Doc, optionally in a specific Drive folder (goes through the Drive API; needs drive.file scope).",
         inputSchema: {
             title: { type: "string", required: true },
@@ -23,6 +24,7 @@ export function registerDocumentsActions(rl) {
         },
     });
     rl.registerAction("document.createBlank", {
+        access: "write",
         description: "Create a blank Google Doc through the native Docs API. Use document.create when you need Drive folder placement.",
         inputSchema: {
             title: { type: "string", required: true },
@@ -33,6 +35,7 @@ export function registerDocumentsActions(rl) {
         },
     });
     rl.registerAction("document.get", {
+        access: "read",
         description: "Get a document. Accepts a bare ID or a docs.google.com URL. `simple=true` collapses the body to plain text.",
         inputSchema: {
             document: {
@@ -67,6 +70,7 @@ export function registerDocumentsActions(rl) {
         },
     });
     rl.registerAction("document.batchUpdate", {
+        access: "write",
         description: "Raw passthrough to documents.batchUpdate — pass a full `requests` array for atomic multi-edit operations.",
         inputSchema: {
             document: { type: "string", required: true },

package/dist/plugins/googleDocs/src/formatting.js

@@ -1,6 +1,7 @@
 import { compact, extractDocumentId, runBatchUpdate } from "./shared.js";
 export function registerFormattingActions(rl) {
     rl.registerAction("document.updateParagraphStyle", {
+        access: "write",
         description: "Apply paragraph styling (alignment, named style, indents, spacing, direction) to the paragraphs intersecting the range.",
         inputSchema: {
             document: { type: "string", required: true },
@@ -96,6 +97,7 @@ export function registerFormattingActions(rl) {
         },
     });
     rl.registerAction("document.updateNamedStyle", {
+        access: "write",
         description: "Update a named style such as NORMAL_TEXT, TITLE, or HEADING_1 using a Docs API NamedStyle object.",
         inputSchema: {
             document: { type: "string", required: true },

package/dist/plugins/googleDocs/src/images.js

@@ -1,6 +1,7 @@
 import { buildLocation, extractDocumentId, runBatchUpdate } from "./shared.js";
 export function registerImagesActions(rl) {
     rl.registerAction("document.insertInlineImage", {
+        access: "write",
         description: "Insert an inline image at the given location. `uri` must point to a publicly fetchable image.",
         inputSchema: {
             document: { type: "string", required: true },
@@ -36,6 +37,7 @@ export function registerImagesActions(rl) {
         },
     });
     rl.registerAction("document.replaceImage", {
+        access: "write",
         description: "Replace an existing image (identified by its inline-object id) with a new image from a publicly fetchable URI.",
         inputSchema: {
             document: { type: "string", required: true },