feat: expand and harden Remote MCP tools - #62

Summary

Implements the evidence-driven Compact v2 Remote MCP surface for Coder without making model A/B evals a release gate.

The design is based on two inputs:

• production MCP history (20k+ requests in the analyzed snapshot, with SSH/remote work and Git among the strongest shell escape-hatch workloads), and
• patterns used by mature MCP servers: semantic tools, static toolsets, server-enforced read-only filtering, and explicit safety boundaries.

Curated MCP surface

The developer catalog is now 34 tools including recent_activity.

New semantic tools:

• remote_hosts
• copy_path
• remove_path
• http_fetch
• http_request
• git_query
• git_mutate
• code_query
• code_rename

Remote transport is a host parameter on existing file/search/exec/process/semantic tools instead of a duplicated remote_* tool family.

Remote safety model

• remote_hosts exposes only exact SSH aliases explicitly configured in the workspace user's SSH config.
• Arbitrary hostname/IP/user@host targets are rejected at the Agent transport boundary.
• Assistant-facing schemas no longer expose identity_file; SSH credentials stay in workspace SSH config.
• Remote file/search/process helpers enforce the same alias validation.
• copy_path validates both endpoints before constructing its transfer pipeline.

Semantic safety boundaries

• HTTP reads (GET/HEAD) are exposed as http_fetch; mutations (POST/PUT/PATCH/DELETE) are isolated in http_request.
• Git reads are exposed as git_query; local mutations are isolated in git_mutate. Network Git (fetch/pull/push) intentionally remains in exec because it crosses a credential/open-world boundary.
• Read-only Git disables hooks, fsmonitor, textconv/external diff, and submodule traversal where relevant. Remote URLs are sanitized before returning them.
• Semantic code reads use code_query; semantic rename is a separate mutating code_rename tool.
• The readonly toolset includes remote_hosts, http_fetch, git_query, and code_query, and excludes all corresponding mutating tools.

Durable execution / MCP observation

• Keeps command lifetime independent from MCP request lifetime.
• Adds a deployment-configurable MCP call observation ceiling (CODER_MCP_TOOL_TIMEOUT_MAX, default 4m40s) while durable Agent processes continue independently.
• exec/bash can return the existing durable process_id when observation ends instead of killing/restarting work.
• Runtime MCP schema limits are cloned per registration so one session cannot mutate shared SDK schema maps.

Activity/history hygiene

• HTTP request bodies and header values are redacted from persisted MCP activity metadata.
• URL credentials/query/fragment are sanitized by the existing persistent-activity path.
• New semantic tools are included in activity tool discovery automatically.

Validation

All of the following passed before creating this PR:

• go test ./codersdk/toolsdk (full suite, including real Agent/DB integration cases)
• go test ./coderd/mcp (full MCP E2E/toolset/activity/transport suite)
• go test ./agent/sshconfig ./agent/agentfiles ./agent/agentproc ./codersdk/workspacesdk ./codersdk
• go test ./agent -run '^$'
• go test ./coderd -run '^$'
• go build ./cmd/coder
• golangci-lint run --new-from-rev origin/custom/v2.35.3 ./agent/sshconfig ./agent/agentfiles ./agent/agentproc ./codersdk/toolsdk ./codersdk/workspacesdk ./coderd/mcp
• Windows compile-only checks (GOOS=windows GOARCH=amd64 go test -c) for agentproc, agentfiles, and toolsdk
• git diff --cached --check

For DB-backed suites, an isolated local PostgreSQL 16 instance was used inside the workspace; production DB was not touched.

The repository-wide pre-commit generator was also run. It completed generation/format passes and then surfaced pre-existing stale generated API/docs output from older custom Activity/Volume Copy work. Those unrelated multi-megabyte generated diffs were intentionally not folded into this PR; the new mcpToolTimeoutMax server-config golden and generated TypeScript deployment type are included.

No deployment is performed by this PR.