fix(app): enable scoped auto-accept settings

[BrandCage]

Issue for this PR

Closes #37617

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Passes the active directory and server into the v2 general settings controller, so auto-accept can be changed from a selected home project, a draft, or a session. The switch stays disabled when there is no active directory.

The server is part of the scope so a remote project's permission request is not sent to whichever server happens to be selected globally. This includes the draft-route fix proposed in #42331 and also covers the selected home project shown in #37617.

How did you verify your code works?

• bun run typecheck
• bun run typecheck:e2e
• bun run build
• Oxlint on the four changed files: 0 warnings and 0 errors
• Playwright regression tests for home, draft, no-scope, and session settings: 4 passed

Screenshots / recordings

No styling changes. The disabled state before this fix is described in #37617; the Playwright regression verifies the switch's enabled, disabled, and checked states and the target server/directory.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Based on the search results, here are related PRs (excluding the current PR #43193):

Potentially Related:

1. PR fix(app): enable directory auto-accept settings #42331 - fix(app): enable directory auto-accept settings

   • fix(app): enable directory auto-accept settings #42331
   • This PR is directly mentioned in the current PR's description as a draft-route fix that is included. Likely this PR builds upon or supersedes that work.

2. PR feat(app): persist auto-accept permissions preference across sessions #39328 - feat(app): persist auto-accept permissions preference across sessions

   • feat(app): persist auto-accept permissions preference across sessions #39328
   • This is a related feature addressing auto-accept permissions, though it appears to focus on persistence across sessions rather than scoped settings.

Note: The current PR (#43193) appears to be the most recent iteration addressing auto-accept scoping, as the description mentions it includes the fix from #42331 and expands it to cover additional scopes (home project, draft, session).

[Enough1122]

AI code review — automated review for reference; please use your judgment.

• packages/app/src/components/settings-v2/dialog-settings-v2.tsx:32 — The home-route scope returns layout.home.selection() after checking only directory; if a stored selection carries a directory whose server key is missing/stale, scopeServer becomes undefined and createPermissionScopeController silently falls back to the focused server's permission state (general-controllers.ts:44) — in multi-server setups that toggle could write auto-accept to the wrong server; validate selection.server (or normalize against ServerConnection) before exposing the scope.
• packages/app/src/components/settings-v2/general-controllers.ts:50 — set() adds a no-op short-circuit (isAutoAcceptingDirectory === checked) for the directory path but none for the session path, which calls enable/disable unconditionally; harmless today, but the asymmetry invites drift — give both branches the same idempotence guard.
• packages/app/src/components/settings-v2/dialog-settings-v2.tsx:41 — After the home/dir-new-session/draft branches, the code reads route.sessionId without explicitly narrowing to route.type === "session"; this compiles only while every remaining union member happens to carry sessionId, and a future route kind would silently resolve undefined instead of failing at compile time — add the explicit guard as documentation-by-types.
• packages/app/e2e/regression/remote-session-settings.spec.ts:11 — Both new scoping tests assert only the enable direction (switch on, request observed); the disable round-trip through toggleAutoAcceptDirectory — including the second click being a no-op thanks to the new guard — has no end-to-end coverage, and that's exactly where a state regression would hide.

— AI code review (automated)

[Enough1122]

AI code review — automated review for reference; please use your judgment.

• packages/app/src/components/settings-v2/dialog-settings-v2.tsx:29 (scope) — after the early returns, the final branch dereferences route.sessionId / route.server without an explicit route.type === "session" guard; it compiles only because every remaining route variant carries those fields. An explicit guard would keep this safe if new route types are added.
• packages/app/src/components/settings-v2/general-controllers.ts:56 (set) — small asymmetry: the directory path checks isAutoAcceptingDirectory(dir) === checked before toggling, but the session path calls enable/disable unconditionally. Harmless today, but aligning them avoids redundant server round-trips.
• packages/app/src/components/settings-v2/general-controllers.ts:38 (state) — falling back to the ambient permission context when no scoped server exists is subtle; consider a comment noting which store that hits (global vs first server) so future readers know what "unscoped" means.
• E2E coverage of home/draft/session scopes plus the disabled-without-scope case is thorough — nice work asserting request origin and directory query params.