runline 0.7.7 → 0.8.0

package/dist/plugins/_shared/imageFile.js

@@ -0,0 +1,40 @@
+/**
+ * Shared helper for image-generation plugins: write generated bytes to a
+ * file and return its path, instead of returning raw base64.
+ *
+ * Base64 image payloads in an action result bloat the agent context and are
+ * stripped by many hosts before reaching the model, so the agent can never
+ * actually deliver the image. A file `path` hands straight to a host
+ * send_file/attachment tool. Plugins load in-process via jiti, so node:fs is
+ * available (same pattern as googleDrive/googleSlides).
+ */
+import { writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+const MIME_EXT = {
+    "image/png": "png",
+    "image/jpeg": "jpg",
+    "image/jpg": "jpg",
+    "image/webp": "webp",
+    "image/gif": "gif",
+    "image/svg+xml": "svg",
+};
+export function extForMime(mimeType) {
+    if (!mimeType)
+        return "png";
+    return MIME_EXT[mimeType] ?? mimeType.split("/")[1]?.split("+")[0] ?? "png";
+}
+/**
+ * Decode base64 image bytes and write them to `saveDir` (or the OS temp dir),
+ * named `<provider>-<stamp>-<index>.<ext>`. Returns the file path + size.
+ */
+export function writeImageFile(opts) {
+    const mimeType = opts.mimeType ?? "image/png";
+    const dir = (typeof opts.saveDir === "string" && opts.saveDir.trim()) || tmpdir();
+    const bytes = Buffer.from(opts.base64 ?? "", "base64");
+    const stamp = opts.stamp ?? Date.now();
+    const path = join(dir, `${opts.provider}-${stamp}-${opts.index}.${extForMime(mimeType)}`);
+    writeFileSync(path, bytes);
+    return { path, mimeType, byteLength: bytes.length };
+}
+export const SEND_FILE_NOTE = "Image(s) written to disk. Deliver each to the user with send_file using its `path`.";

package/dist/plugins/_shared/microsoftAuth.js

@@ -0,0 +1,100 @@
+const REFRESH_SKEW_MS = 60_000;
+function authority(cfg) {
+    return `https://login.microsoftonline.com/${cfg.tenantId || "common"}/oauth2/v2.0/token`;
+}
+export function isAppOnly(cfg) {
+    return !cfg.refreshToken && !!(cfg.tenantId && cfg.clientId && cfg.clientSecret);
+}
+/** Graph path prefix for the acting principal: /me (delegated) or /users/{upn} (app-only). */
+export function userBase(ctx) {
+    const cfg = ctx.connection.config;
+    if (cfg.refreshToken)
+        return "/me";
+    if (cfg.userUpn)
+        return `/users/${encodeURIComponent(cfg.userUpn)}`;
+    throw new Error("microsoft: app-only mode requires userUpn (target mailbox/drive). Set MS_GRAPH_USER_UPN, or connect via OAuth.");
+}
+export async function microsoftAccessToken(ctx, pluginName, scopes) {
+    const cfg = ctx.connection.config;
+    if (cfg.accessToken &&
+        typeof cfg.accessTokenExpiresAt === "number" &&
+        Date.now() < cfg.accessTokenExpiresAt - REFRESH_SKEW_MS) {
+        return cfg.accessToken;
+    }
+    let body;
+    if (cfg.refreshToken) {
+        if (!cfg.clientId || !cfg.clientSecret) {
+            throw new Error(`${pluginName}: missing clientId/clientSecret for OAuth refresh.`);
+        }
+        body = new URLSearchParams({
+            client_id: cfg.clientId,
+            client_secret: cfg.clientSecret,
+            refresh_token: cfg.refreshToken,
+            grant_type: "refresh_token",
+            scope: [...scopes, "offline_access"].join(" "),
+        });
+    }
+    else if (isAppOnly(cfg)) {
+        body = new URLSearchParams({
+            client_id: cfg.clientId,
+            client_secret: cfg.clientSecret,
+            grant_type: "client_credentials",
+            scope: "https://graph.microsoft.com/.default",
+        });
+    }
+    else {
+        throw new Error(`${pluginName}: no credentials. Connect via OAuth, or set tenantId/clientId/clientSecret (app-only).`);
+    }
+    const res = await fetch(authority(cfg), {
+        method: "POST",
+        headers: { "Content-Type": "application/x-www-form-urlencoded" },
+        body: body.toString(),
+    });
+    if (!res.ok) {
+        throw new Error(`${pluginName}: token request failed (${res.status}): ${await res.text()}`);
+    }
+    const data = (await res.json());
+    const patch = {
+        accessToken: data.access_token,
+        accessTokenExpiresAt: Date.now() + data.expires_in * 1000,
+    };
+    // Microsoft rotates refresh tokens — persist the new one when present.
+    if (data.refresh_token)
+        patch.refreshToken = data.refresh_token;
+    await ctx.updateConnection(patch);
+    return data.access_token;
+}
+/** Authenticated Graph v1.0 request. Returns parsed JSON ({success:true} for 204). */
+export async function graphRequest(ctx, pluginName, scopes, method, path, body) {
+    const token = await microsoftAccessToken(ctx, pluginName, scopes);
+    const init = {
+        method,
+        headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+    };
+    if (body !== undefined) {
+        init.headers["Content-Type"] = "application/json";
+        init.body = JSON.stringify(body);
+    }
+    const res = await fetch(`https://graph.microsoft.com/v1.0${path}`, init);
+    if (res.status === 204)
+        return { success: true };
+    const text = await res.text();
+    if (!res.ok)
+        throw new Error(`${pluginName}: ${method} ${path} → ${res.status} ${text}`);
+    return text ? JSON.parse(text) : { success: true };
+}
+/** Setup help shown by the OAuth wizard for all Microsoft plugins. */
+export function microsoftSetupHelp(apiName) {
+    return [
+        `You need a Microsoft Entra (Azure AD) app registration. One-time, ~5 minutes.`,
+        "",
+        "1. Register an app: https://entra.microsoft.com → App registrations → New registration.",
+        "   Supported account types: your org (single tenant) is fine.",
+        "2. Add a Web redirect URI (Authentication → Add platform → Web):",
+        "     {{redirectUri}}",
+        "3. Certificates & secrets → New client secret → copy the VALUE (not the Secret ID).",
+        `4. API permissions → Add → Microsoft Graph → Delegated → add the ${apiName} scopes,`,
+        "   then 'Grant admin consent'.",
+        "5. Paste the Application (client) ID and the client secret VALUE below.",
+    ];
+}

package/dist/plugins/gmail/src/index.js

@@ -108,6 +108,18 @@ function header(name, value) {
 function foldedBase64ByteLength(length) {
     return length === 0 ? 0 : length + Math.floor((length - 1) / 76) * CRLF.length;
 }
+function normalizeMimeBase64(value, index) {
+    const compact = value.replace(/\s+/g, "");
+    if (!/^[A-Za-z0-9+/=_-]*$/.test(compact)) {
+        throw new Error(`gmail: attachment ${index} contentBase64 contains invalid base64 characters`);
+    }
+    const standard = compact.replace(/-/g, "+").replace(/_/g, "/");
+    const remainder = standard.length % 4;
+    if (remainder === 1) {
+        throw new Error(`gmail: attachment ${index} contentBase64 has invalid base64 length`);
+    }
+    return remainder === 0 ? standard : `${standard}${"=".repeat(4 - remainder)}`;
+}
 function foldBase64(encoded) {
     let folded = "";
     for (let i = 0; i < encoded.length; i += 76) {
@@ -147,7 +159,7 @@ function normalizeAttachment(input, index) {
     return {
         name: input.name ?? input.filename ?? `attachment-${index + 1}`,
         mimeType: input.mimeType ?? "application/octet-stream",
-        contentBase64,
+        contentBase64: normalizeMimeBase64(contentBase64, index),
     };
 }
 function attachmentPart(att) {

package/dist/plugins/googleAppsScript/src/index.js

@@ -0,0 +1,203 @@
+import { googleAccessToken } from "../../_shared/googleAuth.js";
+const SCRIPT_API = "https://script.googleapis.com/v1";
+const DRIVE_API = "https://www.googleapis.com/drive/v3";
+const SCOPES = [
+    "https://www.googleapis.com/auth/script.projects",
+    "https://www.googleapis.com/auth/script.deployments",
+    "https://www.googleapis.com/auth/script.processes",
+    "https://www.googleapis.com/auth/drive.metadata.readonly",
+];
+function accessToken(ctx) {
+    return googleAccessToken(ctx, "googleAppsScript", SCOPES);
+}
+async function call(ctx, method, url, payload) {
+    const headers = { Authorization: `Bearer ${await accessToken(ctx)}` };
+    if (payload !== undefined)
+        headers["Content-Type"] = "application/json";
+    const res = await fetch(url, {
+        method,
+        headers,
+        body: payload !== undefined ? JSON.stringify(payload) : undefined,
+    });
+    const text = await res.text();
+    let json;
+    try {
+        json = text ? JSON.parse(text) : {};
+    }
+    catch {
+        json = { raw: text };
+    }
+    if (!res.ok) {
+        const msg = json?.error?.message || json?.error_description || text.slice(0, 300) || res.status;
+        throw new Error(`googleAppsScript: ${method} ${res.status}: ${msg}`);
+    }
+    return json;
+}
+export default function googleAppsScript(rl) {
+    rl.setName("googleAppsScript");
+    rl.setVersion("1.0.0");
+    rl.setConnectionSchema({
+        clientId: { type: "string", required: false, description: "OAuth client ID", env: "GOOGLE_APPS_SCRIPT_CLIENT_ID" },
+        clientSecret: { type: "string", required: false, description: "OAuth client secret", env: "GOOGLE_APPS_SCRIPT_CLIENT_SECRET" },
+        refreshToken: { type: "string", required: false, description: "OAuth refresh token", env: "GOOGLE_APPS_SCRIPT_REFRESH_TOKEN" },
+        serviceAccountJson: { type: "string", required: false, description: "Service-account key JSON", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_JSON" },
+        serviceAccountEmail: { type: "string", required: false, description: "Service-account email", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_EMAIL" },
+        serviceAccountPrivateKey: { type: "string", required: false, description: "Service-account private key", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_PRIVATE_KEY" },
+        serviceAccountSubject: { type: "string", required: false, description: "User to impersonate (domain-wide delegation)", env: "GOOGLE_APPS_SCRIPT_SERVICE_ACCOUNT_SUBJECT" },
+    });
+    rl.registerAction("script.list", {
+        description: "List Apps Script projects in Drive (standalone scripts; bound scripts live inside their container and don't appear here).",
+        inputSchema: {
+            query: { type: "string", required: false, description: "Case-insensitive name substring filter." },
+            pageSize: { type: "number", required: false, description: "Max results (default 50)." },
+        },
+        async execute(input, ctx) {
+            const params = new URLSearchParams({
+                q: "mimeType='application/vnd.google-apps.script' and trashed=false",
+                fields: "files(id,name,modifiedTime)",
+                pageSize: String(input.pageSize ?? 50),
+                orderBy: "modifiedTime desc",
+            });
+            const res = await call(ctx, "GET", `${DRIVE_API}/files?${params}`);
+            let files = res.files ?? [];
+            if (input.query) {
+                const q = String(input.query).toLowerCase();
+                files = files.filter((f) => (f.name || "").toLowerCase().includes(q));
+            }
+            return { count: files.length, scripts: files };
+        },
+    });
+    rl.registerAction("project.getContent", {
+        description: "Get all files of an Apps Script project (name, type, source).",
+        inputSchema: { scriptId: { type: "string", required: true } },
+        async execute(input, ctx) {
+            const res = await call(ctx, "GET", `${SCRIPT_API}/projects/${input.scriptId}/content`);
+            return { scriptId: input.scriptId, files: res.files ?? [] };
+        },
+    });
+    rl.registerAction("project.readFile", {
+        description: "Read one file's source from a project.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            name: { type: "string", required: true, description: "File name without extension (e.g. 'Code', 'appsscript')." },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "GET", `${SCRIPT_API}/projects/${input.scriptId}/content`);
+            const file = (res.files ?? []).find((f) => f.name === input.name);
+            if (!file)
+                throw new Error(`No file "${input.name}". Available: ${(res.files ?? []).map((f) => f.name).join(", ")}`);
+            return { name: file.name, type: file.type, source: file.source };
+        },
+    });
+    rl.registerAction("file.edit", {
+        description: "Replace (or add) a single file's source, leaving other files untouched. Read-modify-write — the safe way to change code.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            name: { type: "string", required: true },
+            source: { type: "string", required: true },
+            type: { type: "string", required: false, description: "SERVER_JS (default), HTML, or JSON (for appsscript)." },
+        },
+        async execute(input, ctx) {
+            const cur = await call(ctx, "GET", `${SCRIPT_API}/projects/${input.scriptId}/content`);
+            const files = cur.files ?? [];
+            const idx = files.findIndex((f) => f.name === input.name);
+            const type = input.type || (input.name === "appsscript" ? "JSON" : files[idx]?.type || "SERVER_JS");
+            const entry = { name: input.name, type, source: input.source };
+            if (idx >= 0)
+                files[idx] = entry;
+            else
+                files.push(entry);
+            await call(ctx, "PUT", `${SCRIPT_API}/projects/${input.scriptId}/content`, { files });
+            return { scriptId: input.scriptId, updated: input.name, fileCount: files.length };
+        },
+    });
+    rl.registerAction("project.updateContent", {
+        description: "Replace the entire project file set. files = [{name, type, source}], must include the appsscript JSON manifest. Prefer file.edit for single changes.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            files: { type: "array", required: true, description: "[{name, type: SERVER_JS|HTML|JSON, source}]" },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "PUT", `${SCRIPT_API}/projects/${input.scriptId}/content`, { files: input.files });
+            return { scriptId: input.scriptId, fileCount: (res.files ?? []).length };
+        },
+    });
+    rl.registerAction("project.create", {
+        description: "Create a new Apps Script project. Pass parentId (a Drive file id, e.g. a Sheet) to bind it to that container.",
+        inputSchema: {
+            title: { type: "string", required: true },
+            parentId: { type: "string", required: false, description: "Container Drive file id for a bound script." },
+        },
+        async execute(input, ctx) {
+            const payload = { title: input.title };
+            if (input.parentId)
+                payload.parentId = input.parentId;
+            const res = await call(ctx, "POST", `${SCRIPT_API}/projects`, payload);
+            return { scriptId: res.scriptId, title: res.title, parentId: res.parentId };
+        },
+    });
+    rl.registerAction("version.create", {
+        description: "Create an immutable version of the project (needed before deploying).",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            description: { type: "string", required: false },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "POST", `${SCRIPT_API}/projects/${input.scriptId}/versions`, { description: input.description || "" });
+            return { scriptId: input.scriptId, versionNumber: res.versionNumber, description: res.description };
+        },
+    });
+    rl.registerAction("deployment.create", {
+        description: "Deploy a version. For function.run, deploy with an API-executable manifest (executionApi access).",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            versionNumber: { type: "number", required: true },
+            description: { type: "string", required: false },
+            manifestFileName: { type: "string", required: false, description: "Defaults to 'appsscript'." },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "POST", `${SCRIPT_API}/projects/${input.scriptId}/deployments`, {
+                versionNumber: input.versionNumber,
+                manifestFileName: input.manifestFileName || "appsscript",
+                description: input.description || "",
+            });
+            return { deploymentId: res.deploymentId, entryPoints: res.entryPoints };
+        },
+    });
+    rl.registerAction("function.run", {
+        description: "Run a function via scripts.run. Requires the project linked to a standard GCP project, the Apps Script API enabled, and an API-executable deployment (or devMode for the owner).",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            functionName: { type: "string", required: true },
+            parameters: { type: "array", required: false, description: "Positional args for the function." },
+            devMode: { type: "boolean", required: false, description: "Run latest saved code (owner only). Default true." },
+        },
+        async execute(input, ctx) {
+            const res = await call(ctx, "POST", `${SCRIPT_API}/scripts/${input.scriptId}:run`, {
+                function: input.functionName,
+                parameters: input.parameters ?? [],
+                devMode: input.devMode === undefined ? true : input.devMode,
+            });
+            if (res.error) {
+                const d = res.error.details?.[0];
+                throw new Error(`Function error: ${d?.errorMessage || res.error.message}`);
+            }
+            return { done: res.done, result: res.response?.result ?? null };
+        },
+    });
+    rl.registerAction("process.list", {
+        description: "Recent executions for a project (status, function, times) — a log view.",
+        inputSchema: {
+            scriptId: { type: "string", required: true },
+            pageSize: { type: "number", required: false, description: "Default 20." },
+        },
+        async execute(input, ctx) {
+            const params = new URLSearchParams({
+                "userProcessFilter.scriptId": input.scriptId,
+                pageSize: String(input.pageSize ?? 20),
+            });
+            const res = await call(ctx, "GET", `${SCRIPT_API}/processes?${params}`);
+            return { count: (res.processes ?? []).length, processes: res.processes ?? [] };
+        },
+    });
+}

package/dist/plugins/googleImage/src/index.js

@@ -6,15 +6,20 @@
  * API key. Kept under the `googleImage` namespace so it doesn't
  * collide with `googleDrive`, `googleDocs`, etc.
  *
- *   await googleImage.image.create({ prompt: "a watercolor fox" })
- *   await googleImage.image.create({
- *     prompt: "edit: make the sky stormier",
- *     model: "gemini-3-pro-image-preview",
- *   })
+ *   const { images } = await googleImage.image.create({ prompt: "a watercolor fox" })
+ *   // images[0].path -> "/tmp/googleImage-….png"
+ *
+ * Generated images are written to disk and the action returns their file
+ * `path`s — never raw base64, which bloats the agent context and is
+ * stripped before delivery. Hand each `path` to the host's file-sending
+ * tool (e.g. send_file) to deliver the image.
  *
  * Nano Banana supports conversational editing — chain prompts in
  * follow-up calls and it'll keep iterating on the last image.
  */
+import { writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 const BASE = "https://generativelanguage.googleapis.com/v1beta/models";
 export default function googleImage(rl) {
     rl.setName("googleImage");
@@ -28,7 +33,7 @@ export default function googleImage(rl) {
         },
     });
     rl.registerAction("image.create", {
-        description: "Generate an image with Google's Gemini image models (Nano Banana / Imagen). Returns base64 bytes per candidate.",
+        description: "Generate an image with Google's Gemini image models (Nano Banana / Imagen). Writes the image(s) to disk and returns their file `path`s — not base64. Deliver each image to the user with send_file using its `path`.",
         inputSchema: {
             prompt: {
                 type: "string",
@@ -40,6 +45,11 @@ export default function googleImage(rl) {
                 required: false,
                 description: "gemini-2.5-flash-image (Nano Banana, default) | gemini-3-pro-image-preview | gemini-3.1-flash-image-preview",
             },
+            saveDir: {
+                type: "string",
+                required: false,
+                description: "Directory to write the image file(s) into. Defaults to the OS temp dir.",
+            },
         },
         async execute(input, ctx) {
             const p = (input ?? {});
@@ -62,18 +72,27 @@ export default function googleImage(rl) {
                 throw new Error(`Google API error ${res.status}: ${await res.text()}`);
             }
             const data = (await res.json());
+            const dir = (typeof p.saveDir === "string" && p.saveDir.trim()) || tmpdir();
+            const stamp = Date.now();
             const images = [];
             for (const candidate of data.candidates ?? []) {
                 for (const part of candidate.content?.parts ?? []) {
                     if (part.inlineData?.data) {
-                        images.push({
-                            base64: part.inlineData.data,
-                            mimeType: part.inlineData.mimeType ?? "image/png",
-                        });
+                        const mimeType = part.inlineData.mimeType ?? "image/png";
+                        const ext = mimeType.includes("jpeg") ? "jpg" : mimeType.split("/")[1] || "png";
+                        const bytes = Buffer.from(part.inlineData.data, "base64");
+                        const path = join(dir, `googleImage-${stamp}-${images.length}.${ext}`);
+                        writeFileSync(path, bytes);
+                        images.push({ path, mimeType, byteLength: bytes.length });
                     }
                 }
             }
-            return { provider: "googleImage", model, images };
+            return {
+                provider: "googleImage",
+                model,
+                images,
+                note: "Image(s) written to disk. Deliver each to the user with send_file using its `path`.",
+            };
         },
     });
 }

package/dist/plugins/microsoftCalendar/src/index.js

@@ -0,0 +1,46 @@
+import { graphRequest, microsoftSetupHelp, userBase } from "../../_shared/microsoftAuth.js";
+const NAME = "microsoftCalendar";
+const SCOPES = ["https://graph.microsoft.com/Calendars.Read"];
+export default function microsoftCalendar(rl) {
+    rl.setName(NAME);
+    rl.setVersion("1.0.0");
+    rl.setConnectionSchema({
+        tenantId: { type: "string", required: false, env: "MS_GRAPH_TENANT_ID", description: "Entra tenant id (app-only) or omit for OAuth /common" },
+        clientId: { type: "string", required: false, env: "MS_GRAPH_CLIENT_ID", description: "App (client) id" },
+        clientSecret: { type: "string", required: false, env: "MS_GRAPH_CLIENT_SECRET", description: "Client secret VALUE" },
+        refreshToken: { type: "string", required: false, env: "MICROSOFTCALENDAR_REFRESH_TOKEN", description: "OAuth2 refresh token (set by the login flow)" },
+        userUpn: { type: "string", required: false, env: "MS_GRAPH_USER_UPN", description: "App-only only: target user UPN" },
+    });
+    rl.setOAuth({
+        authUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+        scopes: [...SCOPES, "offline_access"],
+        setupHelp: microsoftSetupHelp("Calendars.Read"),
+    });
+    rl.registerAction("calendar.list", {
+        description: "List calendar events in a date range. Returns [{id,subject,start,end,location,organizer,attendees}].",
+        inputSchema: {
+            start: { type: "string", required: true, description: "ISO start datetime, e.g. 2026-05-01T00:00:00Z" },
+            end: { type: "string", required: true, description: "ISO end datetime" },
+            top: { type: "number", required: false, default: 50 },
+        },
+        async execute(input, ctx) {
+            const qs = new URLSearchParams({
+                startDateTime: input.start,
+                endDateTime: input.end,
+                $top: String(input.top ?? 50),
+                $select: "id,subject,start,end,location,organizer,attendees,isAllDay,webLink",
+                $orderby: "start/dateTime",
+            });
+            const r = await graphRequest(ctx, NAME, SCOPES, "GET", `${userBase(ctx)}/calendarView?${qs}`);
+            return r.value;
+        },
+    });
+    rl.registerAction("event.get", {
+        description: "Get one calendar event by id (full details incl. body).",
+        inputSchema: { id: { type: "string", required: true } },
+        async execute(input, ctx) {
+            return graphRequest(ctx, NAME, SCOPES, "GET", `${userBase(ctx)}/events/${input.id}`);
+        },
+    });
+}

package/dist/plugins/microsoftFiles/src/index.js

@@ -0,0 +1,127 @@
+import { graphRequest, microsoftAccessToken, microsoftSetupHelp, userBase, } from "../../_shared/microsoftAuth.js";
+const NAME = "microsoftFiles";
+const SCOPES = [
+    "https://graph.microsoft.com/Files.ReadWrite.All",
+    "https://graph.microsoft.com/Sites.ReadWrite.All",
+];
+/** Resolve the drive root path: explicit drive/site, else the user's default drive. */
+function driveBase(ctx) {
+    const cfg = ctx.connection.config;
+    if (cfg.driveId)
+        return `/drives/${cfg.driveId}`;
+    if (cfg.siteId)
+        return `/sites/${cfg.siteId}/drive`;
+    return `${userBase(ctx)}/drive`;
+}
+async function binaryFetch(ctx, method, path, body) {
+    const token = await microsoftAccessToken(ctx, NAME, SCOPES);
+    const init = {
+        method,
+        headers: {
+            Authorization: `Bearer ${token}`,
+            ...(body ? { "Content-Type": "application/octet-stream" } : {}),
+        },
+    };
+    if (body)
+        init.body = body;
+    return fetch(`https://graph.microsoft.com/v1.0${path}`, init);
+}
+export default function microsoftFiles(rl) {
+    rl.setName(NAME);
+    rl.setVersion("1.0.0");
+    rl.setConnectionSchema({
+        tenantId: { type: "string", required: false, env: "MS_GRAPH_TENANT_ID", description: "Entra tenant id (app-only) or omit for OAuth /common" },
+        clientId: { type: "string", required: false, env: "MS_GRAPH_CLIENT_ID", description: "App (client) id" },
+        clientSecret: { type: "string", required: false, env: "MS_GRAPH_CLIENT_SECRET", description: "Client secret VALUE" },
+        refreshToken: { type: "string", required: false, env: "MICROSOFTFILES_REFRESH_TOKEN", description: "OAuth2 refresh token (set by the login flow)" },
+        userUpn: { type: "string", required: false, env: "MS_GRAPH_USER_UPN", description: "App-only only: target user UPN (their OneDrive)" },
+        siteId: { type: "string", required: false, env: "MS_SHAREPOINT_SITE_ID", description: "Optional SharePoint site id (use its default drive)" },
+        driveId: { type: "string", required: false, env: "MS_GRAPH_DRIVE_ID", description: "Optional explicit drive id (overrides site/user)" },
+    });
+    rl.setOAuth({
+        authUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
+        tokenUrl: "https://login.microsoftonline.com/common/oauth2/v2.0/token",
+        scopes: [...SCOPES, "offline_access"],
+        setupHelp: microsoftSetupHelp("Files.ReadWrite.All, Sites.ReadWrite.All"),
+    });
+    rl.registerAction("files.search", {
+        description: "Search the drive for files/folders by text. Returns [{id,name,size,lastModifiedDateTime,webUrl,folder?}].",
+        inputSchema: {
+            query: { type: "string", required: true },
+            top: { type: "number", required: false, default: 25 },
+        },
+        async execute(input, ctx) {
+            const q = encodeURIComponent(String(input.query).replace(/'/g, "''"));
+            const qs = new URLSearchParams({
+                $top: String(input.top ?? 25),
+                $select: "id,name,size,lastModifiedDateTime,webUrl,folder,file",
+            });
+            const r = await graphRequest(ctx, NAME, SCOPES, "GET", `${driveBase(ctx)}/root/search(q='${q}')?${qs}`);
+            return r.value;
+        },
+    });
+    rl.registerAction("files.list", {
+        description: "List children of a folder (default the drive root, or pass folderId).",
+        inputSchema: {
+            folderId: { type: "string", required: false, description: "Folder item id; omit for root" },
+            top: { type: "number", required: false, default: 100 },
+        },
+        async execute(input, ctx) {
+            const where = input.folderId ? `/items/${input.folderId}/children` : "/root/children";
+            const qs = new URLSearchParams({
+                $top: String(input.top ?? 100),
+                $select: "id,name,size,lastModifiedDateTime,webUrl,folder,file",
+            });
+            const r = await graphRequest(ctx, NAME, SCOPES, "GET", `${driveBase(ctx)}${where}?${qs}`);
+            return r.value;
+        },
+    });
+    rl.registerAction("files.get", {
+        description: "Download a file by id. Returns {id,name,size,contentType,base64}. base64 is the file bytes.",
+        inputSchema: { id: { type: "string", required: true } },
+        async execute(input, ctx) {
+            const meta = await graphRequest(ctx, NAME, SCOPES, "GET", `${driveBase(ctx)}/items/${input.id}`);
+            const res = await binaryFetch(ctx, "GET", `${driveBase(ctx)}/items/${input.id}/content`);
+            if (!res.ok)
+                throw new Error(`${NAME}: download ${input.id} → ${res.status} ${await res.text()}`);
+            const buf = Buffer.from(await res.arrayBuffer());
+            return {
+                id: meta.id,
+                name: meta.name,
+                size: meta.size,
+                contentType: meta.file?.mimeType,
+                base64: buf.toString("base64"),
+            };
+        },
+    });
+    rl.registerAction("files.upload", {
+        description: "Upload a file (base64) to a path in the drive, e.g. a dedicated output folder. Returns the created item. For files up to ~4MB.",
+        inputSchema: {
+            path: { type: "string", required: true, description: "Drive-relative path incl. filename, e.g. 'Agent Output/report.docx'" },
+            base64: { type: "string", required: true, description: "File content, base64-encoded" },
+        },
+        async execute(input, ctx) {
+            const bytes = Buffer.from(input.base64, "base64");
+            const p = input.path.split("/").map(encodeURIComponent).join("/");
+            const res = await binaryFetch(ctx, "PUT", `${driveBase(ctx)}/root:/${p}:/content`, bytes);
+            if (!res.ok)
+                throw new Error(`${NAME}: upload ${input.path} → ${res.status} ${await res.text()}`);
+            return JSON.parse(await res.text());
+        },
+    });
+    rl.registerAction("folder.create", {
+        description: "Create a folder (e.g. a dedicated agent output folder) under the drive root or a parent.",
+        inputSchema: {
+            name: { type: "string", required: true },
+            parentId: { type: "string", required: false, description: "Parent folder id; omit for root" },
+        },
+        async execute(input, ctx) {
+            const where = input.parentId ? `/items/${input.parentId}/children` : "/root/children";
+            return graphRequest(ctx, NAME, SCOPES, "POST", `${driveBase(ctx)}${where}`, {
+                name: input.name,
+                folder: {},
+                "@microsoft.graph.conflictBehavior": "rename",
+            });
+        },
+    });
+}