fix(daemon): gate dynamic stdio MCP spawn (H6 / DR-038)

[sudhirverma]

Summary

Closes finding H6: dynamic RegisterMcpServer with transport: stdio previously spawned command / args directly, so any caller with mcp_register (or anyone when consumers were unset) could run arbitrary host commands.

This change fails closed before any process is spawned:

• Allowlist — command must match security.stdio_command_allowlist (basename or absolute path). Empty / omitted allowlist denies all dynamic stdio.
• Operator approval — allowlisted spawns wait for dashboard / POST /api/mcp/stdio-spawns/:requestId unless stdio_require_approval: false.
• Auth — when consumers is configured, stdio command/args require an authenticated consumer with mcp_register.

Config-file mcp_servers remain admin-trusted and skip these gates. Prefer caller-spawned HTTP/SSE for dynamic registration (DR-025). Documented as DR-038.

Config

security:
  max_dynamic_mcp_servers: 10
  stdio_command_allowlist:
    - npx
    - uvx
  stdio_require_approval: true

API / UI

Surface	Purpose
GET /api/mcp/stdio-spawns	Pending approvals + recent denials
POST /api/mcp/stdio-spawns/:requestId	{ "decision": "allow" | "deny" }
Dashboard → MCP Servers	Pending spawn cards + denial list

Denials return clear gRPC PERMISSION_DENIED reasons and are logged as [StdioMCP] DENIED: ….

Test plan

• Unit: non-allowlisted /bin/sh rejected; StdioMCPTransport not constructed
• Unit: allowlisted command + approve → spawn; deny / missing handler → no spawn
• Unit: empty allowlist fail-closed; config-based connect() skips allowlist
• Integration E2E (mcp-stdio-spawn-policy.test.ts):
  • Register /bin/sh → denied, no spawn, denial visible via API
  • Register allowlisted npx → pending approval → approve → process starts
  • No token / wrong capability when consumers enabled → PERMISSION_DENIED
• Manual: set allowlist in config.yaml, start web dashboard, approve a pending stdio spawn from MCP Servers tab
• Manual: confirm denial reason appears under “Recent stdio spawn denials”

Related

• Finding: H6
• Issue: AAP-82828
• Related consumer auth: AAP-82832
• Decision: DR-038