feat: add Gmail scopes and bump workspace-mcp to 1.17.1

The Google Workspace MCP integration configured with gmail:send
permission requires cumulative Gmail scopes (readonly, labels,
modify, compose, send) but we only requested gmail.send. This
caused sessions to fail connecting to the Google MCP server when
Gmail access was needed. Also bumps workspace-mcp from 1.14.2 to
1.17.1.

Users with existing tokens will need to disconnect and reconnect
Google to pick up the new scopes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Ambient Code Bot

components/backend/handlers/oauth.go

@@ -71,6 +71,12 @@ func getOAuthProvider(provider string) (*OAuthProvider, error) {
 				"https://www.googleapis.com/auth/drive",
 				"https://www.googleapis.com/auth/drive.readonly",
 				"https://www.googleapis.com/auth/drive.file",
+				// Gmail scopes for gmail:send permission level (cumulative in workspace-mcp)
+				// Includes: readonly, organize (labels+modify), drafts (compose), and send
+				"https://www.googleapis.com/auth/gmail.readonly",
+				"https://www.googleapis.com/auth/gmail.labels",
+				"https://www.googleapis.com/auth/gmail.modify",
+				"https://www.googleapis.com/auth/gmail.compose",
 				"https://www.googleapis.com/auth/gmail.send",
 			},
 		}, nil

components/runners/ambient-runner/.mcp.json

@@ -26,7 +26,7 @@
     "google-workspace": {
       "command": "uvx",
       "args": [
-        "workspace-mcp@1.14.2",
+        "workspace-mcp@1.17.1",
         "--permissions",
         "gmail:send",
         "drive:full"