Phase 4D: Implement MCP integration and permission model

[timkicker]

Goal

AI daemon orchestrates tool calls via MCP. First-party apps expose MCP servers via os-sdk boilerplate.

Scope

• AI daemon as MCP client, dispatches to app MCP servers
• Tool discovery at runtime (model does not need to know the app ahead of time)
• CLI tools invoked as subprocess via stdout (no MCP server needed)

Read-only servers (permitted by default)

• File Manager: list_directory, file metadata
• Calendar: upcoming and past events
• Browser: history and open tabs (no passwords, no form data)
• System Monitor: process list, resource usage
• Notes: titles and content

Write/action servers (per-session authorization required)

• Terminal: execute shell commands
• File Manager: create, move, rename, delete files
• Calendar: create and modify events
• Email: compose and send
• Store: install and remove packages

Authorization rules

• Granted once per session, scope-specific
• Expires at session end, not persisted
• Hardcoded always-requires-confirmation regardless of session permissions:
  permanent deletion, sending any external message, installing/removing packages,
  modifying system config outside ~/.config, network requests outside declared permissions,
  elevated privilege commands
• Third-party Store MCP servers always treated as action-requiring

References

Blueprint Sections 5.4, 5.7, Figure 7, Tables 7-8