Self-host: elicitation_mode=native approvals never reach the client (JSON response mode) and time out after 60s #2140

Title: Self-host: elicitation_mode=native approvals never reach the client (JSON response mode) and time out after 60s

What happens

With /mcp?elicitation_mode=native on the self-hosted server, calling a tool
whose policy is require_approval from execute never produces an
elicitation/create at the client. After ~60 s the call fails:

[executor:quickjs] tool dispatch defect {
  path: "slack_com.org.<conn>.slack_send_message", ...
tool dispatch failed McpNativeElicitationTransportError:
  [cause]: McpError: MCP error -32001: Request timed out
error: Internal tool error [c52da670]

The client (Hermes Agent v0.21.5, MCP Python SDK) advertises elicitation
support. Executor logs it as
{"clientCapabilities":{"elicitation":{"form":{},"url":{}}},"elicitationSupport":{"form":true,"url":true},"elicitationMode":"native","resumeEnabled":false}.
But the client's elicitation handler is never invoked (its metrics stay at 0
requests), and the tool call returns Internal tool error at 60.0 s on both
attempts.

Likely cause

packages/hosts/mcp/src/in-memory-session-store.ts creates the transport with
enableJsonResponse: true. The native handler sends the elicitation with
server.server.elicitInput(params, { relatedRequestId })
(packages/hosts/mcp/src/tool-server.ts). In JSON-response mode, the POST
carrying tools/call is answered with a single JSON body, so there is no SSE
stream for that request on which a request-related server→client message can
be delivered. As far as I can tell it is neither sent on that response nor
routed to the standalone GET stream, so the client never sees it and the
server-side request hits the SDK's default 60 s timeout.

Separately, even when delivered, the SDK's default 60 s request timeout is
short for a human approving on an async surface (chat buttons); the
client-side default we use is 300 s. Related: #2133.

Repro

1. Self-host v1.6.10 (Docker), any integration with a tool under a
   require_approval org policy.
2. Connect an MCP client that supports form elicitation to
   /mcp?elicitation_mode=native.
3. From execute, call that tool.
4. Observe: no elicitation/create reaches the client; execute fails at
   ~60 s with McpNativeElicitationTransportError / -32001 Request timed out.

Suggested fix

• For sessions in native mode, don't use enableJsonResponse, so the
  tools/call response is an SSE stream that can carry the related
  elicitation/create. Or route related server→client requests to the
  standalone GET stream when the POST is answered as JSON.
• Pass an explicit, longer timeout to elicitInput for approvals (e.g. 5 min,
  or configurable via env).

Security note

This matters because the default model mode lets the agent approve its own
require_approval calls with resume(accept). native is the mode that puts
a human in the loop through the client's approval UI, and it's currently
unusable on self-host.

Environment

• executor-selfhost v1.6.10 (Docker, ghcr.io/usefulsoftwareco/executor-selfhost:v1.6.10)
• Client: Hermes Agent v0.21.5 (MCP Python SDK), streamable HTTP