fix(deploy): correct the Google MCP wiring for newly created agents

[juniperbevensee]

Scope, stated honestly up front

A newly created agent's Google MCP previously could not start. After this it starts, can authenticate, and persists its tokens — but it grants nothing until an operator adds Drive folder IDs. That limit is deliberate (see Security below), not an oversight. The original title said "make Google MCP actually work"; that oversold it.

Four defects, all silent

#	Defect	Symptom
1	GOOGLE_MCP_DIR probed only ~/Documents/GitHub/google-multiplayer-mcp; the repo is commonly cloned as google-mcp	operator ticks "Google", gets no Google — no mount, no mcp_servers entry, no error
2	--config /opt/google/config.yaml	only /opt/google/tokens is mounted → readFileSync → exit 1
3	nothing wrote a permission config anywhere	no file to read even with 1 and 2 fixed
4	GOOGLE_TOKEN_DIR set nowhere	server fell back to $HOME/.nimbleco-google/tokens; with HOME=/opt/data the /opt/google/tokens mount was dead weight

Plus: GOOGLE_CLIENT_ID/SECRET were never provisioned and HSM never writes ~/.nimbleco-google/config.json, so loadGlobalConfig() always threw and OAuth was impossible regardless of scoping. Now written to the agent .env (from the request, else inherited from HSM's own env) and referenced from the mcp_servers env block.

Security: why the default grants nothing

google-multiplayer-mcp's permissions.ts:

/** Get allowed folder IDs for a service. Empty array = no restriction. */

Empty folders means unrestricted. So drive: {access: write, folders: []} would hand every new agent unscoped read/write over an entire Google account. The wizard collects no folder IDs, so every service generates at access: none, with a header explaining how to scope it. A test asserts every generated service is none, not a sampled few.

Found while fixing the above

generateEnvContent wrote a wizard-supplied Brave key as BRAVE_API_KEY only. The runtime reads exclusively BRAVE_SEARCH_API_KEY (plugins/web/brave_free/provider.py, plus the auto-detect table in tools/web_tools.py); nothing reads BRAVE_API_KEY. The key was invisible to the agent — so the search_backend: brave-free pin also added here would have fallen straight through to auto-detect, inert on exactly the agents it was for. Both names are now written.

Independent audit findings, all addressed

BLOCKING — the preflight ran after side effects. The 400 sat below mkdirSync and the .env write and returned from inside the try, making the catch's cleanup unreachable. A rejected deploy left a half-created agent dir containing the resolved plaintext LLM key, then 409'd every retry of that name forever — recoverable only by rm -rf from a shell. On the Letta runtime it orphaned an already-created brain agent too. The file states the correct rule two functions above: "before a single door byte is written." The preflight now sits above every side effect, including the Letta branch.

Also fixed: unvalidated googleIdentity interpolated into YAML ("a: b" breaks the parse and exits the server — reintroducing this very bug; a newline could inject permission entries past the deny-by-default); the probe now requires node_modules as well as dist/index.js (the bundle imports bare googleapis/js-yaml, so a pruned checkout passed and exited 1 at runtime); non-absolute GOOGLE_MCP_DIR is rejected (Docker reads a relative volume source as a named volume, mounting an empty dir over the bundle); the 400 carries ok: false; and the generated OAuth runbook now passes GOOGLE_TOKEN_DIR and the client creds, without which it hit EROFS on the read-only container.

Testing

18 route-level integration tests running the real deploy logic and real fs writes against temp dirs — including that a rejected deploy leaves no dir, no docker start, no key-registry writes, and that the same name is still deployable afterwards.

Mutation-verified rather than trusted green: reverting each of the six fixes individually fails a test (preflight position → 4 failures; the other five → 1 each). 911 passed on the real tree, tsc --noEmit clean.

Note for reviewers: this repo has stale .wt-* worktree directories that vitest collects by default and which fail for unrelated reasons — run with --exclude '**/.wt-*/**'.

Not in this PR

duplicateOverlay recursively copies the agent data dir, so a duplicate inherits the source's google-permissions.yaml and its google-tokens/ — sharing Google identity and OAuth tokens between agents. Same isolation concern the code already handles for surface env vars; deserves its own change.

🤖 Generated with Claude Code