Finish OAuth permissions + live-test the scope-gated v0.5.0 tools

[mabry1985]

v0.5.0 shipped everything; the current refresh token (the old Ava grant) predates the wider scope set, so the last mile is Google Cloud console work + a Reconnect + a live test. Everything through v0.4.0 works on the current token.

1 · Google Cloud (one-time, ~5 min)

• Enable the People API and Google Docs API on the project holding the OAuth client (Gmail/Calendar/Drive are already enabled).
• Confirm the consent screen is Internal (protolabs.studio) — no verification, no 7-day token expiry.
• Client type decision — the desktop sidecar now binds a dynamic port (58224 at last check), so pre-registered URIs are fragile:
  • Recommended: use a "Desktop app"-type OAuth client — Google's loopback rule accepts http://127.0.0.1:<any port>/… redirects with no URI registration at all, port-proof for you and any org member.
  • Alternative: keep the Web-application client and add http://localhost:7870/plugins/google/oauth/callback + :7871 (only works while the server is actually on those ports).
• If you minted a new client: update GOOGLE_WORKSPACE_CLIENT_ID / GOOGLE_WORKSPACE_CLIENT_SECRET in Infisical (project secret-management, env prod) and paste into Settings ▸ Plugins ▸ Google on each instance.

2 · Reconnect

• Google panel → Reconnect → approve. Defaults now request all six scopes: gmail.modify, calendar, drive.readonly, contacts.readonly, contacts.other.readonly, documents. Token lands in secrets.yaml automatically; effective immediately, no restart.

3 · Live-test the remainder (the scope-gated tools)

• contacts_search — ask the agent to find a known contact's email (checks both saved + auto-collected contacts).
• docs_create — "write X up as a doc"; confirm the doc appears in Drive with the content and the returned link opens.
• calendar_create_event — timed event with timezone + an all-day event; confirm both land on the primary calendar and that the tool refuses any attendee phrasing (schema has no attendees param).
• Calendar write on the token: also verifies whether the calendar scope granted is rw (untested on the old token).
• Bonus end-to-end: "find 's email, check when I'm free next week, draft a reply proposing a time, put a hold on my calendar" — exercises contacts → free/busy → draft → event in one conversation.
• Partner onboarding smoke: same client id/secret on their machine, Connect with their protolabs.studio account, confirm their agent reads their inbox.

Context: shipped across v0.2.0–v0.5.0 (#1–#8); scope-gated tools return a readable insufficient authentication scopes — reconnect error until step 2.

🤖 Generated with Claude Code