feat: Phase 3 — MCP header fallback, LIKE-based consent window, and auth token fix for dsh integration

- X-Oikos-Session-Id header → context fallback for _session_id
- sessionIDFromArgsOrContext() reads from args, then header
- AssentWindowActive falls back to session-ID-only LIKE lookup
- windowActiveLike() for LIKE-pattern autonomy_settings queries
- mcpBearerToken: package-level resolved token replaces os.Getenv() in decide_approval
- Bump 0.36.0 → 0.37.0

internal/mcp/server.go

@@ -53,6 +53,7 @@ func objSchema(props ...prop) *jsonschema.Schema {
 // NewHandler creates an http.Handler that serves the Oikos MCP server.
 // agentID is the Nomos agent entity UUID; tool calls are logged to agent_activity.
 func NewHandler(pool *db.Pool, token string, agentID uuid.UUID, sec ports.Secrets, entities *app.EntityService, relService *app.RelationshipService, execSvc *app.ExecutionService) http.Handler {
+	mcpBearerToken = token
 	s := newServer(pool, agentID, sec, entities, relService, execSvc)
 	handler := mcp.NewStreamableHTTPHandler(func(r *http.Request) *mcp.Server {
 		if token != "" {
@@ -62,7 +63,35 @@ func NewHandler(pool *db.Pool, token string, agentID uuid.UUID, sec ports.Secret
 		}
 		return s
 	}, nil)
-	return handler
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Extract X-Oikos-Session-Id from headers and store in context.
+		if sid := r.Header.Get("X-Oikos-Session-Id"); sid != "" {
+			r = r.WithContext(context.WithValue(r.Context(), ctxSessionIDKey{}, sid))
+		}
+		handler.ServeHTTP(w, r)
+	})
+}
+
+// ctxSessionIDKey is a Go context key for X-Oikos-Session-Id header value.
+type ctxSessionIDKey struct{}
+
+// mcpBearerToken is the resolved MCP bearer token, set at startup from the
+// config (after Infisical overlay). Used by decide_approval and similar
+// handlers that call back into the oikos HTTP API.
+var mcpBearerToken string
+
+// sessionIDFromArgsOrContext returns _session_id from tool call args,
+// falling back to the X-Oikos-Session-Id header injected into the request
+// context. This lets dsh agents send the session ID as a header without
+// injecting it into every tool call's arguments.
+func sessionIDFromArgsOrContext(ctx context.Context, args map[string]any) string {
+	if sid, _ := args["_session_id"].(string); sid != "" {
+		return sid
+	}
+	if sid, ok := ctx.Value(ctxSessionIDKey{}).(string); ok {
+		return sid
+	}
+	return ""
 }
 
 // toolHandler is the function signature registered via AddTool.