refac

README.md

@@ -573,7 +573,8 @@ Granular permissions mode provides service-by-service scope control:
 - Gmail levels: `readonly`, `organize`, `drafts`, `send`, `full` (cumulative)
 - Other services currently support: `readonly`, `full`
 - `--permissions` and `--read-only` are mutually exclusive
-- With `--tool-tier`, only tier-matched tools are enabled and only services with matching tier tools are imported
+- `--permissions` cannot be combined with `--tools`; enabled services are determined by the `--permissions` entries (optionally filtered by `--tool-tier`)
+- With `--tool-tier`, only tier-matched tools are enabled and only services that have tools in the selected tier are imported
 
 **★ Tool Tiers**
 ```bash

auth/permissions.py

@@ -179,7 +179,7 @@ def get_scopes_for_permission(service: str, level: str) -> List[str]:
             f"Valid levels: {valid}"
         )
 
-    return list(set(cumulative))
+    return sorted(set(cumulative))
 
 
 def get_all_permission_scopes() -> List[str]:

main.py

@@ -190,7 +190,7 @@ def main():
             "Example: --permissions gmail:organize drive:readonly. "
             "Gmail levels: readonly, organize, drafts, send, full (cumulative). "
             "Other services: readonly, full. "
-            "Mutually exclusive with --read-only."
+            "Mutually exclusive with --read-only and --tools."
         ),
     )
     args = parser.parse_args()