fix(app): show MCP elicitation forms in desktop and web - #58305

Problem

An MCP server can ask the user for input partway through a tool call (elicitation/create). Since #58184 the TUI shows these forms, but the desktop and web app only render forms of kind question and websearch.provider. In the app the form never appears, and the tool call waits until the server gives up.

App support was originally added in #35064, lost in the #35080 revert, and not reapplied when #35115 restored the core side.

Change

 createSessionRequestModel
   formRequest          // session tree: question | websearch.provider
+                       //               | mcp-elicitation
+  elicitationRequest   // session-tree form, else a "global" form for the session's Location
+  sync("global", session.location)
   blocked = permission || question || elicitation || websearch

 <SessionComposerRegion>
   <SessionWebSearchDock />
   <SessionQuestionDock />
+  <SessionElicitationDock />   // new
   <SessionPermissionDock />

• New SessionElicitationDock. Shows the form title, the server's message, and one control per field: a switch for booleans, number inputs for number and integer fields, a select for string choices, text inputs for free strings, checkboxes for multiselect, and the URL with an Open button for URL-mode elicitations. Submit replies and Dismiss (or Escape) cancels.
• Global forms. Elicitations are owned by the "global" sentinel session, so the model also lists and syncs global forms for the session's Location. Replies and cancellations go through data.session.form.reply/cancel, which add the Location header for global forms.
• Strings. Adds one English string, session.elicitation.selectPlaceholder. Everything else reuses existing keys.
• Stories. Adds two Storybook stories, MCP elicitation request and MCP URL elicitation request. The Storybook data mock gains no-op form.reply/cancel.

Demo

This is the production web build against a local backend. A stdio MCP server's deploy tool asks for approve (boolean), environment (staging | production) and notes (string). The server received:

{ "action": "accept", "content": { "approve": true, "environment": "production", "notes": "Ships the MCP elicitation dock." } }

Out of scope

• Forms are still owned by the "global" session, so an elicitation shows in every session view for that Location.

Verification

• bun test … ./src/session/requests in packages/app: 26 pass, including a new case for mcp-elicitation forms in sessionFormRequest.
• bun run typecheck in packages/app and bun run check at the root: pass, 34/34 tasks.
• Live in the web app as in the demo above. Dismiss and server-side cancellation were also exercised against the same backend.