feat(bridge): forward upstream MCP tools through the bridge with daemon-side allowlist gating

[benhoverter]

Depends on RightNow-AI#1205. Do not merge until that lands; this PR is stacked on feat/bridge-tool-surface-v2. Diff-vs-base shows only the upstream-forwarding work.

Summary

Lets bridge-fronted agents call upstream MCP tools (Linear, Notion, etc.) without baking each one into the static ALLOWED_TOOLS table. The bridge asks the daemon for the agent's permitted upstream surface at handshake, advertises those tools to the rmcp client alongside built-ins, and routes mcp_{server}_{tool} invocations through the existing IPC. The daemon stays the source of truth for per-agent gating and tool dispatch.

Changes

Layer	Change
Protocol (openfang-mcp-bridge/src/protocol.rs)	New ListUpstreamRequest, UpstreamToolDef, UpstreamListResponse, UpstreamListResult. New Frame::ListUpstream / Frame::UpstreamList variants. Forward-compat: unknown type tags reject cleanly (serde error, no panic).
Daemon dispatch (openfang-api/src/bridge_ipc.rs)	handle_list_upstream walks kernel.mcp_connections and returns the agent's permitted upstream tools. dispatch_upstream_mcp_call routes mcp_{server}_{tool} through the MCP registry, bypassing the static ALLOWED_TOOLS gate via an early branch. Request loop multiplexes Frame::Call and Frame::ListUpstream.
Bridge plumbing (openfang-mcp-bridge/src/lib.rs, main.rs)	list_upstream() round-trip runs once after handshake() while the bridge still owns the stream, then spawn_ipc_actor() takes the halves. Results are cached on IpcDispatcher. Bridge::permitted_tools() appends upstream tools after built-ins. Local accept gate: name in allowed OR (starts_with("mcp_") AND advertised in cache).
Discovery hardening (openfang-runtime/src/mcp.rs)	RESERVED_BUILTIN_NAMES mirrors ALLOWED_TOOLS. New register_discovered_tool helper skips (with WARN) any upstream tool whose namespaced form shadows a built-in or duplicates a same-server entry (catches get-teams vs get_teams normalization collisions). Drift test pins RESERVED_BUILTIN_NAMES == ALLOWED_TOOLS.

Per-commit:

• dadc6f1 — protocol variants + tests, no behavior change
• 5d33a4a — daemon dispatch + list_upstream handler
• 8180191 — bridge handshake plumbing + advertise + dispatch
• 52b4fba — discovery-time collision check + drift test
• 8afe35a — cargo fmt --all on the touched crates (whitespace only)
• 71639c0 — post-review: sandbox hard-deny on ~/.mcp-auth/ (MCP-02)
• 4e0f71a — post-review: list_upstream timeout + drift test + UTF-8 audit comment (MCP-06/08/09)

Testing

• cargo fmt --all -- --check passes
• cargo clippy -p openfang-runtime -p openfang-api -p openfang-mcp-bridge --tests -- -D warnings passes
• cargo test on touched crates passes:
  • openfang-mcp-bridge --lib --bins → 16/16 (4 new, including list_upstream_handshake_and_mcp_dispatch end-to-end, permitted_tools_appends_upstream_after_builtins, is_advertised_upstream_matches_only_advertised_names, list_upstream_propagates_error_result)
  • openfang-api --lib bridge_ipc → 19/19 (4 new: ipc_list_upstream_roundtrip, ipc_mcp_call_through_twin_returns_canned_ok, reserved_builtin_names_matches_allowed_tools drift guard, no_builtin_uses_mcp_prefix drift guard)
  • openfang-runtime --lib (sandbox + mcp) → all green, +1 sandbox unit test for .mcp-auth/ deny
• Live integration smoked against a local daemon with bridge-fronted agents:
  • Full surface: mcp_linear_*, mcp_notion_*, mcp_figma_*, mcp_supabase_* all callable end-to-end from an agent with the matching mcp_servers allowlist.
  • Gating verified by removing supabase from one agent's mcp_servers: the entire Supabase tool surface stopped being advertised (not just rejected at call time) — confirms the schema-layer gate.
  • mcp_servers = [] → zero upstream surface advertised. Default-deny on the bridge path holds (see Notes below).
  • Daemon restart resilience: bridge + plugin reconnect clean post-deploy-local.sh; no re-priming.
  • Upstream-MCP-server kill resilience: subprocess supervisor respawns transparently; the next tool call succeeds with no cryptic errors surfaced to the agent.
  • Forced exec attempts blocked at the schema layer when an agent has no permitted servers — denied tools aren't in the deferred registry, so a client can't fabricate the call.

New tests are named so they can be grepped:
frame_unknown_variant_is_rejected_cleanly, ipc_list_upstream_roundtrip, ipc_mcp_call_through_twin_returns_canned_ok, reserved_builtin_names_matches_allowed_tools, no_builtin_uses_mcp_prefix, permitted_tools_appends_upstream_after_builtins, is_advertised_upstream_matches_only_advertised_names, list_upstream_handshake_and_mcp_dispatch, list_upstream_propagates_error_result, denies_mcp_auth_home_dir.

Security

• No new unsafe code
• No secrets or API keys in diff
• User input validated at boundaries

Threat-model notes for reviewers:

• Hardened-token lane only. Both handle_list_upstream and dispatch_upstream_mcp_call resolve the agent identity from the Hello token. A legacy self-claimed agent_id on either new path is refused.
• mcp_servers = [] is none on the bridge path (behavior change — see Notes below). The daemon refuses upstream MCP calls and returns an empty advertise list when an agent's allowlist is empty. The in-process path's historical [] = all semantic is left untouched in this PR (tracked: MCP-01 / MCP-05).
• Explicit truncation. Oversized upstream results return is_error = true with a truncation marker; never silently truncated.
• Server-side allowlist is authoritative. The bridge's local mcp_* accept gate is early-exit hygiene only — the daemon re-validates agent.mcp_servers on every call.
• Collision-resistant naming. RESERVED_BUILTIN_NAMES + the discovery-time skip means a future built-in landing under mcp_* (or a misnamed upstream tool) cannot shadow a built-in or collide with a same-server sibling. Drift test guards the invariant; second drift test (no_builtin_uses_mcp_prefix) locks the dispatch-ordering invariant.
• Audit log redaction. Tool arguments are not logged at info level on the new dispatch path; only the tool name + agent id + server.
• Sandbox. ~/.mcp-auth/ OAuth tokens (mcp-remote, etc.) now hard-denied regardless of workspace_root, matching the 421e5d9 deny-outside-$OPENFANG_HOME threat model.

Post-review additions (security-openfang findings folded in)

Security review (_shared/openfang/findings/mcp-forwarding/) flagged 9 findings across the 12 commits in this stack. Four were folded into this PR before merge; the rest are tracked as follow-ups against local-main (see "Follow-ups" below).

Finding	Sev	Disposition	Commit
MCP-02	HIGH	Folded — hard-deny ~/.mcp-auth/ in workspace_sandbox.rs (same threat model as 421e5d9).	71639c0
MCP-06	MED	Folded — tokio::time::timeout(15s) on list_upstream round-trip; downgrades to empty on timeout, matching the existing error path.	4e0f71a
MCP-08	LOW	Folded — no_builtin_uses_mcp_prefix drift test locks the invariant is_mcp_tool dispatch ordering depends on.	4e0f71a
MCP-09	INFO	Folded — UTF-8 4-byte-worst-case assumption named in a comment on the truncation budget.	4e0f71a
MCP-10 / MCP-11 / MCP-12	PASS	No action — reviewer flagged these as reference patterns.	—

Follow-ups (tracked against local-main, not blockers for this PR)

• MCP-01 (CRITICAL, pre-existing): tool_runner.rs:517-545 — in-process MCP path does not consult agent.toml mcp_servers. Out of scope for this bridge PR (kernel/runtime path), but filed concurrently with merge so it is not lost. Requires explicit default-deny-vs-allow+warn decision plus a parity test asserting bridge/in-process semantic equivalence.
• MCP-03 (HIGH): Upstream tool results lack a provenance envelope ("external content from MCP server X, tool Y"). Same structural gap exists today on web_fetch and memory_recall (S9-H / FU-01). Should land all three together so the model sees a consistent boundary marker.
• MCP-04 (MED): Per-tool (not per-server) allowlist granularity in agent.toml. New feature, not a regression; this PR's server-granular gate matches the existing config shape.
• MCP-05 (MED): Resolves automatically when MCP-01 lands (couples to that issue).
• MCP-07 (LOW): UX-only — mid-session manifest changes not reflected in advertise until restart. Dispatch-side gate is the real authority; the partial doc at main.rs:241-246 is sufficient interim.

Notes for reviewers

• Behavior change — mcp_servers = [] on the bridge path. Historically, OpenFang interpreted mcp_servers = [] as "all servers allowed" (see openfang-api/src/routes.rs and the agents TUI's "all" mode). On the new bridge upstream path, [] means none. This is a deliberate default-deny posture for new code — bridge-fronted agents with no MCP intent specified get zero upstream surface advertised instead of every connected MCP server's tools. The in-process path's [] = all semantic is untouched to avoid a blast-radius this PR shouldn't claim. Follow-up planned: converge both paths on [] = none in a dedicated PR with a migration note. Calling this out now as "putting folks on notice."
• Default-empty trait method. ToolDispatcher::upstream_tools() is added with a default empty Vec so existing Box<dyn ToolDispatcher> callsites compile unchanged.
• Schema fallback. upstream_def_to_tool() falls back to an empty object schema when an upstream tool's inputSchema is not an object — keeps rmcp happy on non-conformant servers without a panic.

Out of scope

• Converging the in-process path on [] = none (follow-up PR — MCP-01).
• Per-tool (not per-server) allowlisting (MCP-04).
• Streaming/chunked upstream results — current implementation returns a single response with explicit-truncation semantics.