feat: add trusted/untrusted session source MCP access control

[cyrusagent]

Assignee: Payton
Linear: CYPACK-933

Summary

Adds trusted/untrusted session source MCP access control, allowing operators to restrict which user-configured MCP servers are available to agent sessions based on their originating platform (Linear, GitHub, Slack).

• Schema: New optional sessionSourceTrust and mcpAccess fields on EdgeConfigSchema — fully backward compatible (omitting both preserves current behavior where all sources get all MCPs)
• Runtime filtering: EdgeWorker.getEffectiveMcpConfigPaths() resolves which ~/.cyrus/mcp-configs/ files to load based on source trust level. Built-in MCPs (Linear, Cyrus Tools) are always injected regardless of trust.
• Session source threading: All three session creation paths (Linear, GitHub, Slack/chat) now pass their source identifier through to MCP config resolution
• Hot-reload: ConfigManager detects changes to trust config fields on config file updates

Config example

{
  "sessionSourceTrust": {
    "linear": "trusted",
    "github": "untrusted",
    "slack": "untrusted"
  },
  "mcpAccess": {
    "trusted": ["server-a", "server-b"],
    "untrusted": ["server-a"]
  }
}

With this config, Linear sessions get mcp-server-a.json and mcp-server-b.json, while GitHub and Slack sessions only get mcp-server-a.json.

Files changed

File	Change
packages/core/src/config-schemas.ts	TrustLevelSchema, SessionSourceTrustSchema, McpAccessSchema + EdgeConfigSchema fields
packages/core/src/config-types.ts	Re-export new types
packages/core/src/index.ts	Public API exports
packages/edge-worker/src/EdgeWorker.ts	getEffectiveMcpConfigPaths(), session source threading
packages/edge-worker/src/ChatSessionHandler.ts	mcpConfigPath on deps interface
packages/edge-worker/src/ConfigManager.ts	Hot-reload detection for trust fields
packages/core/test/config-schemas.trust.test.ts	16 schema validation tests
packages/edge-worker/test/EdgeWorker.session-source-trust.test.ts	11 filtering tests

Test plan

• 16 schema tests: TrustLevelSchema, SessionSourceTrustSchema, McpAccessSchema, EdgeConfigSchema integration
• 11 EdgeWorker tests: backward compat, trusted/untrusted filtering, unknown sources, partial configs, edge cases
• All 554 existing edge-worker tests pass
• All 58 existing core tests pass
• TypeScript typecheck clean
• Lint clean (316 files)

🤖 Generated with Claude Code