Ask before MCP tools that aren't read-only under HITL; show MCP results readably

[fuseraft]

Found by testing sql-mcp and a small write-capable MCP server in the full-screen REPL.

Ask before an MCP tool that isn't read-only runs under HITL

HITL asked before shell commands, file writes, Git writes and write-ish HTTP calls, but MCP tools ran without asking, including write tools such as a GitHub server's create_issue.

Now, with HITL on, the REPL asks before a call to an MCP tool unless the server marks the tool read-only (readOnlyHint). Built-in read-only tools already run without asking, so this matches them. The prompt shows the call's arguments:

⏸ MCP notes action requested:
  notes.add_note — text: buy milk
Allow? [y]es [n]o [a]lways: all notes.add_note calls (saved for this directory)

• "Always" covers that one tool on that server and is saved for the directory, as it is for Git and Http.
• A blocked call never reaches the server; the model gets [DENIED].
• The check is a DelegatingAIFunction (ReplMcpApproval) wrapped around the tools at all three places a server connects: saved servers at startup, /mcp add and /mcp login.
• The repl.md, cli-reference.md and mcp.md docs are updated.

fuseraft run --hitl is unchanged: its MCP tools still run without asking.

Show an MCP tool's text, not the SDK's wrapping of it

A successful MCP call reaches the turn as the SDK's TextContent; an error arrives as the CallToolResult JSON. Two places showed that wrapping:

• The "Stopped after 3 consecutive tool failures" warning printed the raw JSON envelope.
• Ctrl+O showed a server's JSON answer as one long line, so a 1,000-row result couldn't be read.

McpToolResult.Display now handles every shape a result arrives in: TextContent, a list of contents, or the envelope JSON. Ctrl+O indents an MCP server's JSON. String results from fuseraft's own tools are left exactly as they are, so a JSON file the model read still appears as it is on disk.

Testing

• New tests in ReplMcpApprovalTests use a real in-process MCP server over pipes. They cover: a read-only tool runs without asking; another tool asks with its arguments and then runs; a blocked call never reaches the server; with HITL off, nothing is wrapped.
• New McpToolResult.Display and renderer tests.
• Full suite: 3,324 passed.
• Checked live in the TUI: denying, "always", /approvals and /approvals clear, the indented Ctrl+O output, and the unwrapped warning.