Preserve MCP settings and number available approval choices

[dimavrem22]

Executive Summary

Preserve configured MCP settings and keep tool approval numbers aligned with the choices shown.

• Scope the runtime configuration override to mcp_servers.inkbox for new and resumed threads.
• Number available approval choices consecutively and decode numeric replies using the same option list.
• Bump the plugin version to 0.2.19 and extend real-host regression coverage.

Description

The bridge supplies a dotted mcp_servers.inkbox override instead of replacing the top-level MCP table. This keeps launcher-supplied settings for other MCP servers intact while retaining the bridge's existing Inkbox configuration.

MCP approval prompts now number only the offered choices. Without session approval, allow-once is option 1 and deny is option 2; if only permanent approval is additionally offered, it becomes option 3. Formatting and numeric reply handling share the same ordered choices. Word replies, structured forms, command approvals, and native persistence semantics stay unchanged. The README explains the request-specific numbering.

Reason

Adding Inkbox should preserve a user's separately configured MCP settings, and replying with a number must select exactly the option shown in that prompt.

Decisions

• Configuration scope: Override only the bridge-managed Inkbox entry so unrelated MCP configuration stays under the user's control.
• Approval choices: Number the offered options consecutively, keeping word replies stable and forwarding only persistence scopes advertised by the host.
• Validation: Exercise native approval requests and actual tool execution, because configuration responses alone do not establish runtime behavior.

Testing

• Companion tool approvals: configure a separate MCP tool with approval_mode="prompt"; both new and resumed bridge sessions must request permission, execute on acceptance, and not execute on denial.
• Real-host configuration regression: all eight cases passed with the scoped override; restoring the original override made all four launcher-policy cases fail.
• Approval numbering: all four persistence combinations have consecutive prompts and matching numeric decisions; unsupported options never become an allow-once grant.
• SMS, iMessage, and email routing: option 2 denies when session scope is absent; option 3 selects permanent approval when that is the only additional offered scope.
• Focused approval, channel-routing, and real-host suite: 172 passed.
• Full local unit and real-host suite: pytest -q --ignore=tests/live — 1,460 passed.
• GitHub CI passed on 5b630ef: Python 3.11/3.12/3.13 units, real-host contracts, SDK compatibility, CodeQL, and full-stack messaging, A2A, voice, and external-event suites.
• Additional isolated verification with Codex 0.156.1 and the official filesystem MCP server: all four decisions worked; allow-once re-prompted, denial prevented writes, session approval expired with a fresh session, and permanent approval survived a fresh host process through native saved configuration.