feat(tools): enforce skill capabilities and secret scopes

src/tools/builtin/gcal.ts

@@ -118,6 +118,7 @@ export function createGcalTools(config: NonNullable<GcalConfig>): Tool[] {
     name: 'calendar.today',
     description:
       "List today's events from Google Calendar. Returns summary, time, location, attendees, and link for each event.",
+    requiredSecretScopes: ['gcal'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -162,6 +163,7 @@ export function createGcalTools(config: NonNullable<GcalConfig>): Tool[] {
     name: 'calendar.list',
     description:
       'List events from Google Calendar in a date range. Returns summary, time, location, attendees, and link for each event.',
+    requiredSecretScopes: ['gcal'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -222,6 +224,7 @@ export function createGcalTools(config: NonNullable<GcalConfig>): Tool[] {
     name: 'calendar.search',
     description:
       'Search Google Calendar events by text query. Returns summary, time, location, attendees, and link for each match.',
+    requiredSecretScopes: ['gcal'],
     inputSchema: {
       type: 'object',
       properties: {

src/tools/builtin/gdocs.ts

@@ -100,6 +100,7 @@ export function createGdocsTools(config: NonNullable<GdocsConfig>): Tool[] {
     name: 'docs.list',
     description:
       'List recent Google Docs documents. Returns id, name, modified time, owners, and link for each document.',
+    requiredSecretScopes: ['gdocs'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -151,6 +152,7 @@ export function createGdocsTools(config: NonNullable<GdocsConfig>): Tool[] {
     name: 'docs.search',
     description:
       'Search Google Docs by name. Returns id, name, modified time, owners, and link for each matching document.',
+    requiredSecretScopes: ['gdocs'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -208,6 +210,7 @@ export function createGdocsTools(config: NonNullable<GdocsConfig>): Tool[] {
     name: 'docs.read',
     description:
       'Read the content of a Google Doc as plain text. Use docs.list or docs.search first to get document IDs.',
+    requiredSecretScopes: ['gdocs'],
     inputSchema: {
       type: 'object',
       properties: {

src/tools/builtin/gdrive.ts

@@ -130,6 +130,7 @@ export function createGdriveTools(config: NonNullable<GdriveConfig>): Tool[] {
     name: 'drive.list',
     description:
       'List recent files from Google Drive. Returns id, name, type, modified time, size, owners, and link.',
+    requiredSecretScopes: ['gdrive'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -199,6 +200,7 @@ export function createGdriveTools(config: NonNullable<GdriveConfig>): Tool[] {
     name: 'drive.search',
     description:
       'Search Google Drive files by name or content. Returns id, name, type, modified time, size, owners, and link.',
+    requiredSecretScopes: ['gdrive'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -270,6 +272,7 @@ export function createGdriveTools(config: NonNullable<GdriveConfig>): Tool[] {
     name: 'drive.read',
     description:
       'Read the content of a Google Drive file. Exports Google Workspace files (Docs, Sheets, Slides) as plain text/CSV. Downloads regular text files directly. Use drive.list or drive.search to get file IDs.',
+    requiredSecretScopes: ['gdrive'],
     inputSchema: {
       type: 'object',
       properties: {

src/tools/builtin/gmail.ts

@@ -152,6 +152,7 @@ export function createGmailTools(config: NonNullable<GmailConfig>): Tool[] {
     name: 'gmail.list',
     description:
       'List recent emails from Gmail. Returns id, from, subject, date, and snippet for each message.',
+    requiredSecretScopes: ['gmail'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -207,6 +208,7 @@ export function createGmailTools(config: NonNullable<GmailConfig>): Tool[] {
     name: 'gmail.search',
     description:
       'Search Gmail using Gmail query syntax (e.g. "from:user@example.com", "is:unread", "subject:hello"). Returns id, from, subject, date, and snippet for each match.',
+    requiredSecretScopes: ['gmail'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -262,6 +264,7 @@ export function createGmailTools(config: NonNullable<GmailConfig>): Tool[] {
     name: 'gmail.read',
     description:
       'Read the full content of a Gmail message by ID. Returns headers (from, to, subject, date) and the full text body. Use gmail.list or gmail.search first to get message IDs.',
+    requiredSecretScopes: ['gmail'],
     inputSchema: {
       type: 'object',
       properties: {

src/tools/builtin/gtasks.ts

@@ -103,6 +103,7 @@ export function createGtasksTools(config: NonNullable<GtasksConfig>): Tool[] {
     name: 'tasks.lists',
     description:
       'List all Google Tasks task lists. Returns id, title, and last updated time for each list.',
+    requiredSecretScopes: ['gtasks'],
     inputSchema: {
       type: 'object',
       properties: {
@@ -149,6 +150,7 @@ export function createGtasksTools(config: NonNullable<GtasksConfig>): Tool[] {
     name: 'tasks.list',
     description:
       'List tasks from a Google Tasks task list. Returns title, status (completed/needsAction), due date, and notes. Use tasks.lists first to get task list IDs.',
+    requiredSecretScopes: ['gtasks'],
     inputSchema: {
       type: 'object',
       properties: {

src/tools/builtin/web-search.ts

@@ -135,6 +135,7 @@ export function createWebSearchTool(config: WebSearchConfig): Tool {
     name: 'web.search',
     description:
       'Search the web for current information. Returns titles, URLs, and snippets from web search results. Use this to find up-to-date information about any topic.',
+    requiredSecretScopes: ['web_search'],
     inputSchema: {
       type: 'object',
       properties: {