feat(cloud): scaffold the read-only cloud-context MCP package and safety harness

[sourcehawk]

Description

Towards #45

Lays the foundation for the read-only cloud-context MCP (pkg/mcp/cloud/): the provider-agnostic interface, the bypass-resistant command harness, the shared identity probe, the four tools, and the serve.go wiring. This is the scaffold every downstream PR builds on — the GCP provider (#43), the AWS provider (#46), and the launcher integration all consume the contracts that land here. No real cloud provider ships in this PR; a fakeProvider drives the package tests, and --provider=gcp|aws reports "not built yet" until B/C wire the implementations.

The security model is the heart of the feature and is implemented by construction here: run_cli never touches a shell, argv is a typed token array (no in-house splitter to fool), a positive allowlist gates the subcommand path, and a hardcoded deny floor the config can never re-enable covers credential-reading subcommands, identity/endpoint flags, and local-file/SSRF argument prefixes.

Changes

• cloud.Provider interface plus projection structs (Inventory, IdentityStatus, CLIResult) and a fakeProvider test double — the contract Implement the GCP provider for the cloud-context MCP #43 and Implement the AWS provider for the cloud-context MCP #46 implement.
• Command allowlist loader (LoadCommandAllowlist) mirroring the k8s LoadAllowlist pattern: embedded default or profile override, always filtered through a hardcoded denyFloor plus provider additions. A too-broad override can never re-enable a floored command.
• Argv validation: exact-match the positional subcommand path (so a surplus metacharacter token can't ride through on an allowed prefix), reject deny-floored flags and arg-prefixes, validate --project/region against the scope allowlist.
• No-shell exec core (execCLI): direct execve, explicit minimal env, closed stdin, output truncation. Shell metacharacters handed in as argv tokens are inert.
• Shared identity probe (cloud.Probe) returning IdentityStatus — the single struct session_status, the connections panel, and preflight all render from. Degrades (Valid:false + Hint), never errors, on a stale credential.
• Four tools (list_inventory, session_status, run_cli, list_allowed_commands) with ToolSpecs() and a wire test that fails if registration drifts from the catalog.
• triagent-mcp serve --kind=cloud --provider=<gcp|aws> wiring, the TRIAGENT_CLOUD_PROVIDER / TRIAGENT_CLOUD_ALLOWLIST_PATH / TRIAGENT_CLOUD_SCOPE env-name constants, and cloud.ToolSpecs() folded into the launcher tool catalog.

Challenges

The metacharacter-rejection guarantee and the allowlist match are the same mechanism: making Allows match the positional subcommand path exactly (rather than as a prefix) is what makes ["compute","instances","list",";","rm"] fail — the surplus ; and rm tokens make the positional path no longer equal any allowlisted entry. That keeps the no-shell guarantee structural rather than relying on string sanitization. The security tests assert both halves: a source-level scan that no "-c" / sh -c construction exists, and a behavioural check that an argv full of metacharacters prints them verbatim and spawns no second process.

Related

• Epic Pluggable read-only cloud-context MCP (GCP and AWS) #44 (cloud-context MCP)
• Implement the GCP provider for the cloud-context MCP #43 (GCP provider), Implement the AWS provider for the cloud-context MCP #46 (AWS provider), and the launcher-integration PR branch from this PR's merged state.

Testing

make test-go is race-clean and green across all 45 packages; make lint reports 0 issues. Every task was built TDD-first (failing test watched fail for the right reason, then implemented). The load-bearing security tests in harness_security_test.go cover the no-shell guarantee (source scan + behavioural metacharacter-inert + minimal-env + truncation); validate_test.go tables every deny-floor flag, arg-prefix, scope pivot, and metacharacter token; tools_wire_test.go guards registration-vs-catalog drift. Reviewers may want to poke at the deny-floor coverage in allowlist.go/validate.go and confirm the Allows exact-match reasoning above holds for their threat model.

🤖 Generated with Claude Code