feat(hub): pass execution MCP servers to agents (#2813)

* feat(hub): pass execution MCP servers to agents

Hub-owned execution capabilities need to reach provider sessions without becoming part of outward agent snapshots. Keep the configuration daemon-private so provider recovery continues to work.

* fix(hub): protect daemon MCP namespace

Hub execution MCP configuration must not replace the daemon-owned Paseo server. Validate only after owned-record lookup so idempotent replay remains stable while new launches fail before provider or durable state creation.

* fix(agent): reject unsupported MCP launches

* fix(agent): scope MCP support guard

* fix(agent): redact MCP metadata from wire payloads

* fix(agent): validate MCP support on restored sessions

* fix(session): rehydrate MCP config on resume

* fix(session): resume newest matching agent record

* fix(session): restore archive state after failed resume

packages/protocol/src/messages.hub.test.ts

@@ -80,6 +80,34 @@ describe("Hub session protocol", () => {
     expect(SessionInboundMessageSchema.parse(message)).toEqual(message);
   });
 
+  test("accepts an optional MCP server configuration on Hub creates", () => {
+    const message = {
+      type: "hub.execution.agent.create.request",
+      requestId: "request-mcp",
+      executionId: "execution-mcp",
+      provider: "codex",
+      cwd: "/workspace",
+      prompt: "Implement the requested change",
+      mcpServers: {
+        hub: {
+          type: "http",
+          url: "https://hub.example/mcp/executions/execution-mcp",
+          headers: { Authorization: "Bearer hub-execution-bearer" },
+        },
+      },
+    };
+
+    expect(SessionInboundMessageSchema.parse(message)).toEqual(message);
+    expect(PreviousHubAgentCreateRequestSchema.parse(message)).toEqual({
+      type: "hub.execution.agent.create.request",
+      requestId: "request-mcp",
+      executionId: "execution-mcp",
+      provider: "codex",
+      cwd: "/workspace",
+      prompt: "Implement the requested change",
+    });
+  });
+
   test.each([
     undefined,
     { mode: "branch-off", newBranch: "hub-work", base: "main" },

packages/protocol/src/messages.ts

@@ -2483,6 +2483,7 @@ export const HubExecutionAgentCreateRequestSchema = z.object({
   thinkingOptionId: z.string().optional(),
   featureValues: z.record(z.string(), z.unknown()).optional(),
   env: z.record(z.string(), z.string()).optional(),
+  mcpServers: z.record(z.string(), McpServerConfigSchema).optional(),
   worktree: CreateAgentWorktreeTargetSchema.optional(),
 });