feat: add server-level MCP auto-approval for wildcard tool servers

MCP servers configured with empty tools arrays (wildcard) now appear in the
auto-approval pill with a server-level toggle. When toggled, a server-level
approval key (mcp_server:<name>) is added to autoApprovedToolNames. The
sidecar matches this key against PermissionRequestMcp.ServerName to auto-
approve all tools from that server without needing individual tool names.

- Add buildMcpServerApprovalKey/isMcpServerApprovalKey helpers
- Create approval groups for all MCP servers including empty-tools ones
- Add serverApprovalKey to ApprovalToolGroup for server-level toggles
- Update sidecar RequiresToolCallApproval to check server-level keys
- Include server-level keys in listApprovalToolNames for pruning safety
- Add tests for both shared domain and sidecar approval matching

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/shared/domain/tooling.ts

@@ -149,6 +149,16 @@ const fallbackRuntimeApprovalTools: ReadonlyArray<RuntimeToolDefinition> = [
   { id: 'store_memory', label: 'Store memory' },
 ];
 
+const MCP_SERVER_APPROVAL_PREFIX = 'mcp_server:';
+
+export function buildMcpServerApprovalKey(serverName: string): string {
+  return `${MCP_SERVER_APPROVAL_PREFIX}${serverName}`;
+}
+
+export function isMcpServerApprovalKey(key: string): boolean {
+  return key.startsWith(MCP_SERVER_APPROVAL_PREFIX);
+}
+
 export function createWorkspaceSettings(): WorkspaceSettings {
   return {
     theme: 'dark',
@@ -262,7 +272,11 @@ export function listApprovalToolNames(
   tooling: WorkspaceToolingSettings,
   runtimeTools?: ReadonlyArray<RuntimeToolDefinition>,
 ): string[] {
-  return listApprovalToolDefinitions(tooling, runtimeTools).map((tool) => tool.id);
+  const toolNames = listApprovalToolDefinitions(tooling, runtimeTools).map((tool) => tool.id);
+  for (const server of tooling.mcpServers) {
+    toolNames.push(buildMcpServerApprovalKey(server.name));
+  }
+  return [...new Set(toolNames)];
 }
 
 export interface ApprovalToolGroup {
@@ -270,6 +284,7 @@ export interface ApprovalToolGroup {
   label: string;
   kind: ApprovalToolKind;
   tools: ApprovalToolDefinition[];
+  serverApprovalKey?: string;
 }
 
 const approvalToolGroupKindOrder: ApprovalToolKind[] = ['builtin', 'mcp', 'lsp', 'mixed'];
@@ -292,6 +307,18 @@ export function groupApprovalToolsByProvider(
     group.tools.push(tool);
   }
 
+  // Ensure every MCP server has a group (even with no declared tools) and
+  // attach server-level approval keys.
+  for (const server of tooling.mcpServers) {
+    const groupId = `mcp:${server.id}`;
+    let group = groups.get(groupId);
+    if (!group) {
+      group = { id: groupId, label: server.name, kind: 'mcp', tools: [] };
+      groups.set(groupId, group);
+    }
+    group.serverApprovalKey = buildMcpServerApprovalKey(server.name);
+  }
+
   return [...groups.values()].sort((a, b) => {
     const kindDiff = approvalToolGroupKindOrder.indexOf(a.kind) - approvalToolGroupKindOrder.indexOf(b.kind);
     if (kindDiff !== 0) return kindDiff;