Security improvements: per-group session isolation, remove built-in Gmail

- Isolate Claude sessions per-group (data/sessions/{group}/.claude/)
  to prevent cross-group access to conversation history
- Remove Gmail MCP from built-in (now available via /add-gmail skill)
- Add SECURITY.md documenting the security model
- Move docs to docs/ folder (SPEC.md, REQUIREMENTS.md, SECURITY.md)
- Update documentation to reflect changes

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

.claude/skills/debug/SKILL.md

@@ -19,8 +19,8 @@ src/container-runner.ts               container/agent-runner/
     │                                      │
     ├── data/env/env ──────────────> /workspace/env-dir/env
     ├── groups/{folder} ───────────> /workspace/group
-    ├── data/ipc ──────────────────> /workspace/ipc
-    ├── ~/.claude/ ────────────────> /home/node/.claude/ (sessions)
+    ├── data/ipc/{folder} ────────> /workspace/ipc
+    ├── data/sessions/{folder}/.claude/ ──> /home/node/.claude/ (isolated per-group)
     └── (main only) project root ──> /workspace/project
 ```
 
@@ -171,14 +171,7 @@ mounts.push({
 
 ### 6. MCP Server Failures
 
-If an MCP server fails to start, the agent may exit. Test MCP servers individually:
-
-```bash
-# Test Gmail MCP
-container run --rm --entrypoint /bin/bash nanoclaw-agent:latest -c '
-  npx -y @gongrzhe/server-gmail-autoauth-mcp --help
-'
-```
+If an MCP server fails to start, the agent may exit. Check the container logs for MCP initialization errors.
 
 ## Manual Container Testing
 
@@ -267,7 +260,7 @@ container run --rm --entrypoint /bin/bash nanoclaw-agent:latest -c '
 
 ## Session Persistence
 
-Claude sessions are stored in `~/.claude/projects/` on the host, mounted to `/home/node/.claude/projects/` inside the container.
+Claude sessions are stored per-group in `data/sessions/{group}/.claude/` for security isolation. Each group has its own session directory, preventing cross-group access to conversation history.
 
 **Critical:** The mount path must match the container user's HOME directory:
 - Container user: `node`
@@ -277,11 +270,11 @@ Claude sessions are stored in `~/.claude/projects/` on the host, mounted to `/ho
 To clear sessions:
 
 ```bash
-# Clear all sessions
-rm -rf ~/.claude/projects/
+# Clear all sessions for all groups
+rm -rf data/sessions/
 
 # Clear sessions for a specific group
-rm -rf ~/.claude/projects/*workspace-group*/
+rm -rf data/sessions/{groupFolder}/.claude/
 
 # Also clear the session ID from NanoClaw's tracking
 echo '{}' > data/sessions.json

.claude/skills/setup/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: setup
-description: Run initial NanoClaw setup. Use when user wants to install dependencies, authenticate WhatsApp/Gmail, register their main channel, or start the background services. Triggers on "setup", "install", "configure nanoclaw", or first-time setup requests.
+description: Run initial NanoClaw setup. Use when user wants to install dependencies, authenticate WhatsApp, register their main channel, or start the background services. Triggers on "setup", "install", "configure nanoclaw", or first-time setup requests.
 ---
 
 # NanoClaw Setup
@@ -286,34 +286,7 @@ Tell the user:
 > }
 > ```
 
-## 9. Gmail Authentication (Optional)
-
-Ask the user:
-> Do you want to enable Gmail integration for reading/sending emails?
->
-> **Note:** This requires setting up Google Cloud Platform OAuth credentials, which involves:
-> 1. Creating a GCP project
-> 2. Enabling the Gmail API
-> 3. Creating OAuth 2.0 credentials
-> 4. Downloading a credentials file
->
-> This takes about 5-10 minutes. Skip if you don't need email integration.
-
-If yes, guide them through the prerequisites:
-1. Go to https://console.cloud.google.com
-2. Create a new project (or use an existing one)
-3. Enable the Gmail API (APIs & Services → Enable APIs → search "Gmail API")
-4. Create OAuth 2.0 credentials (APIs & Services → Credentials → Create Credentials → OAuth client ID → Desktop app)
-5. Download the JSON file and save to `~/.gmail-mcp/gcp-oauth.keys.json`
-
-Then run:
-```bash
-npx -y @gongrzhe/server-gmail-autoauth-mcp
-```
-
-This will open a browser for OAuth consent. After authorization, credentials are cached.
-
-## 10. Configure launchd Service
+## 9. Configure launchd Service
 
 Generate the plist file with correct paths automatically: