@sendinel/mcp-server 1.0.104 → 1.0.105

package/build/lib/action-approvals.d.ts

@@ -46,9 +46,12 @@ export interface ApprovalResult {
     approve_via: string;
     /** One-tap approval page; works on a phone and needs no project switching (#3661). */
     approve_url: string;
+    preview_text: string;
     message: string;
 }
 export declare function approvalPageUrl(approvalId: string): string;
+/** SHA-256 over JSON-compatible params, with recursive stable key ordering. */
+export declare function approvalPayloadHash(action: string, params: unknown): string;
 /**
  * Request human approval for an action. Creates a pending approval token
  * and returns instructions for the agent to wait.

package/build/lib/action-approvals.js

@@ -1,6 +1,8 @@
-import { triggerChangeSummary, decodeHtmlEntities, stripHtmlComments } from '@sendinel/domain';
+import { createHash } from 'node:crypto';
+import { buildApprovalPreview, isHumanApprovalChannel, triggerChangeSummary, decodeHtmlEntities, stripHtmlComments } from '@sendinel/domain';
 import { db, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
+import { captureApprovalSnapshot, withoutApprovalSnapshot } from './approval-snapshot.js';
 import { fireWebhookEvent } from './webhook-events.js';
 /**
  * Action approval tiers:
@@ -303,11 +305,15 @@ function normalizeApprovalParams(value) {
     if (value && typeof value === 'object') {
         return Object.fromEntries(Object.entries(value)
             .filter(([, entryValue]) => entryValue !== undefined)
-            .sort(([a], [b]) => a.localeCompare(b))
+            .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0)
             .map(([key, entryValue]) => [key, normalizeApprovalParams(entryValue)]));
     }
     return value;
 }
+/** SHA-256 over JSON-compatible params, with recursive stable key ordering. */
+export function approvalPayloadHash(action, params) {
+    return createHash('sha256').update(JSON.stringify(normalizeApprovalParams({ action, params }))).digest('hex');
+}
 function approvalParamsEqual(expected, actual) {
     return JSON.stringify(normalizeApprovalParams(expected)) === JSON.stringify(normalizeApprovalParams(actual));
 }
@@ -318,9 +324,18 @@ function approvalParamsEqual(expected, actual) {
 export async function requestApproval(action, params, apiKeyId, channelContext, display) {
     const tier = getApprovalTier(action, params);
     const summary = buildApprovalSummary(action, params, display);
-    const expiresAt = new Date(Date.now() + 30 * 60 * 1000).toISOString();
+    const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
     const { channel, verified } = channelContext ?? currentChannelContext();
     const actor = requestContext();
+    // Ignore any model-supplied reserved field; freeze facts read by the server.
+    const cleanParams = withoutApprovalSnapshot(params);
+    const snapshot = await captureApprovalSnapshot(action, cleanParams, getProjectId());
+    const payload = cleanParams.payload;
+    if (action === 'send_broadcast' && Array.isArray(payload?.contact_ids) && Array.isArray(snapshot.contact_ids) &&
+        !approvalParamsEqual({ ids: [...payload.contact_ids].sort() }, { ids: snapshot.contact_ids })) {
+        throw new Error('Approval audience changed while preparing the preview. Request a new approval.');
+    }
+    const frozenParams = { ...cleanParams, __approval_snapshot: snapshot };
     const { data, error } = await db()
         .from('action_approvals')
         .insert({
@@ -330,7 +345,8 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         agent_label: actor?.agentLabel ?? null,
         action,
         tier,
-        params,
+        params: frozenParams,
+        payload_hash: approvalPayloadHash(action, frozenParams),
         summary,
         expires_at: expiresAt,
         channel,
@@ -355,7 +371,8 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         expires_at: expiresAt,
         approve_via: 'Open approve_url (works on a phone) or Dashboard → Settings → Pending Approvals',
         approve_url: approvalPageUrl(data.id),
-        message: `This action requires human approval. A notification has been sent to your dashboard. Approval ID: ${data.id}. Check status with: poll this approval_id, or wait for the webhook callback (event: approval.decided). Token expires in 30 minutes.`,
+        preview_text: buildApprovalPreview({ action, params: frozenParams, summary }).plain_summary,
+        message: `This action requires human approval. A notification has been sent to your dashboard. Approval ID: ${data.id}. Check status with: poll this approval_id, or wait for the webhook callback (event: approval.decided). Token expires in 24 hours.`,
     };
 }
 /**
@@ -365,7 +382,7 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
 export async function checkApproval(approvalId, options = {}) {
     const { data, error } = await db()
         .from('action_approvals')
-        .select('action, status, decided_by, decided_via, expires_at, used_at, params')
+        .select('action, status, decided_by, decided_via, expires_at, used_at, params, payload_hash, requested_at')
         .eq('id', approvalId)
         .eq('project_id', getProjectId())
         .maybeSingle();
@@ -374,17 +391,29 @@ export async function checkApproval(approvalId, options = {}) {
     if (options.action && data.action !== options.action) {
         return { approved: false, status: 'action_mismatch' };
     }
-    if (options.params && !approvalParamsEqual(options.params, data.params)) {
+    if (options.consume && data.payload_hash) {
+        if (!options.action || !options.params)
+            return { approved: false, status: 'payload_required' };
+        if (approvalPayloadHash(options.action, { ...withoutApprovalSnapshot(options.params), ...(data.params?.__approval_snapshot ? { __approval_snapshot: data.params.__approval_snapshot } : {}) }) !== data.payload_hash ||
+            approvalPayloadHash(data.action, data.params) !== data.payload_hash) {
+            return { approved: false, status: 'payload_changed_after_approval' };
+        }
+    }
+    if (options.params && !approvalParamsEqual(withoutApprovalSnapshot(options.params), withoutApprovalSnapshot(data.params))) {
         return { approved: false, status: 'params_mismatch' };
     }
-    // Check expiry
-    if (data.status === 'pending' && new Date(data.expires_at) < new Date()) {
-        await db()
-            .from('action_approvals')
-            .update({ status: 'expired' })
-            .eq('id', approvalId);
+    // Approved tokens expire too. Invalid timestamps fail closed. Older rows may have a
+    // shorter lifetime; no row can authorize an apply more than 24 hours after its request.
+    const requested = data.requested_at == null ? null : Date.parse(data.requested_at);
+    const expiry = Math.min(Date.parse(data.expires_at), requested == null ? Infinity : requested + 24 * 60 * 60 * 1000);
+    if (!Number.isFinite(expiry) || (requested != null && !Number.isFinite(requested)) || expiry <= Date.now()) {
         return { approved: false, status: 'expired' };
     }
+    if (data.used_at || data.status === 'used')
+        return { approved: false, status: 'consumed' };
+    if (data.status === 'approved' && !isHumanApprovalChannel(data.decided_via)) {
+        return { approved: false, status: 'human_decision_required' };
+    }
     if (data.status !== 'approved' || !options.consume) {
         if (data.used_at)
             return { approved: false, status: 'consumed' };
@@ -394,15 +423,33 @@ export async function checkApproval(approvalId, options = {}) {
             decided_by: data.decided_by,
         };
     }
-    const { data: claimed, error: claimError } = await db()
+    if (data.params?.__approval_snapshot) {
+        try {
+            const current = await captureApprovalSnapshot(data.action, withoutApprovalSnapshot(data.params), getProjectId());
+            if (!approvalParamsEqual(current, data.params.__approval_snapshot)) {
+                return { approved: false, status: 'target_changed_after_approval' };
+            }
+        }
+        catch {
+            return { approved: false, status: 'target_revalidation_failed' };
+        }
+    }
+    if (expiry <= Date.now())
+        return { approved: false, status: 'expired' };
+    const claimQuery = db()
         .from('action_approvals')
         .update({ status: 'used', used_at: new Date().toISOString() })
         .eq('id', approvalId)
         .eq('project_id', getProjectId())
         .eq('status', 'approved')
         .is('used_at', null)
-        .select('decided_by')
-        .maybeSingle();
+        .eq('expires_at', data.expires_at)
+        .gt('expires_at', new Date().toISOString())
+        .eq('decided_via', data.decided_via)
+        .eq('params', JSON.stringify(data.params))
+        .gt('requested_at', new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString());
+    const boundClaim = data.payload_hash ? claimQuery.eq('payload_hash', data.payload_hash) : claimQuery.is('payload_hash', null);
+    const { data: claimed, error: claimError } = await boundClaim.select('decided_by').maybeSingle();
     if (claimError || !claimed) {
         return { approved: false, status: 'consumed' };
     }

package/build/lib/approval-capabilities.d.ts

@@ -0,0 +1,17 @@
+export declare const MCP_APP_EXTENSION = "io.modelcontextprotocol/ui";
+export declare const MCP_APP_MIME_TYPE = "text/html;profile=mcp-app";
+export type ApprovalClientCapabilities = Readonly<{
+    elicitation_form: boolean;
+    elicitation_url: boolean;
+    mcp_app: boolean;
+}>;
+export type ApprovalChannelAvailable = 'mcp_app' | 'mcp_elicitation_form' | 'mcp_elicitation_url' | 'plain_text';
+/** Reads only declared initialize capabilities. No user agent or client-name guessing. */
+export declare function probeApprovalCapabilities(declared: unknown): ApprovalClientCapabilities;
+export declare function rememberApprovalCapabilities(session: object, declared: unknown): ApprovalClientCapabilities;
+export declare function approval_channel_available(session: object): ApprovalChannelAvailable;
+/** Each SDK Server is a session boundary, including stateless HTTP request instances. */
+export declare function installApprovalCapabilityProbe(session: {
+    oninitialized?: () => void;
+    getClientCapabilities(): unknown;
+}): void;

package/build/lib/approval-capabilities.js

@@ -0,0 +1,40 @@
+export const MCP_APP_EXTENSION = 'io.modelcontextprotocol/ui';
+export const MCP_APP_MIME_TYPE = 'text/html;profile=mcp-app';
+const sessions = new WeakMap();
+const object = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : null;
+/** Reads only declared initialize capabilities. No user agent or client-name guessing. */
+export function probeApprovalCapabilities(declared) {
+    const capabilities = object(declared);
+    const elicitation = object(capabilities?.elicitation);
+    const extensions = object(capabilities?.extensions);
+    const app = object(extensions?.[MCP_APP_EXTENSION]);
+    return Object.freeze({
+        // The MCP spec defines elicitation:{} as form support for older clients.
+        elicitation_form: !!elicitation && (Object.keys(elicitation).length === 0 || !!object(elicitation.form)),
+        elicitation_url: !!object(elicitation?.url),
+        mcp_app: !!app && Array.isArray(app.mimeTypes) && app.mimeTypes.includes(MCP_APP_MIME_TYPE),
+    });
+}
+export function rememberApprovalCapabilities(session, declared) {
+    const capabilities = probeApprovalCapabilities(declared);
+    sessions.set(session, capabilities);
+    return capabilities;
+}
+export function approval_channel_available(session) {
+    const capabilities = sessions.get(session);
+    if (capabilities?.mcp_app)
+        return 'mcp_app';
+    if (capabilities?.elicitation_form)
+        return 'mcp_elicitation_form';
+    if (capabilities?.elicitation_url)
+        return 'mcp_elicitation_url';
+    return 'plain_text';
+}
+/** Each SDK Server is a session boundary, including stateless HTTP request instances. */
+export function installApprovalCapabilityProbe(session) {
+    const previous = session.oninitialized;
+    session.oninitialized = () => {
+        rememberApprovalCapabilities(session, session.getClientCapabilities());
+        previous?.call(session);
+    };
+}

package/build/lib/approval-human-callback.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Server integration only. The transport creates this closure for one authenticated human
+ * interaction and retains it outside the tool registry. Neither its id nor decision is a tool
+ * argument. Front ends must call complete only from the matching elicitation/app response.
+ */
+export declare function createHumanApprovalCallback(binding: {
+    approvalId: string;
+    projectId: string;
+    connectionId: string;
+    userId: string;
+    channel: 'mcp_elicitation' | 'mcp_app';
+}): {
+    interactionId: `${string}-${string}-${string}-${string}-${string}`;
+    complete(response: {
+        interactionId: string;
+        connectionId: string;
+        decision: 'approve' | 'reject';
+    }): Promise<boolean>;
+};

package/build/lib/approval-human-callback.js

@@ -0,0 +1,41 @@
+import { randomUUID } from 'node:crypto';
+import { db } from '../db.js';
+/**
+ * Server integration only. The transport creates this closure for one authenticated human
+ * interaction and retains it outside the tool registry. Neither its id nor decision is a tool
+ * argument. Front ends must call complete only from the matching elicitation/app response.
+ */
+export function createHumanApprovalCallback(binding) {
+    const interactionId = randomUUID();
+    let completed = false;
+    return {
+        interactionId,
+        async complete(response) {
+            if (completed || response.interactionId !== interactionId || response.connectionId !== binding.connectionId)
+                return false;
+            if (response.decision !== 'approve' && response.decision !== 'reject')
+                return false;
+            completed = true;
+            const source = db();
+            const client = typeof source.schema === 'function' ? source.schema('email') : source;
+            const now = new Date().toISOString();
+            const { data, error } = await client.from('action_approvals')
+                .update({ status: response.decision === 'approve' ? 'approved' : 'rejected', decided_via: binding.channel,
+                decided_by: binding.userId, decided_at: now })
+                .eq('id', binding.approvalId).eq('project_id', binding.projectId)
+                .eq('status', 'pending').is('used_at', null).gt('expires_at', now)
+                .select('id, payload_hash').maybeSingle();
+            if (error || !data)
+                return false;
+            const { error: auditError } = await client.from('audit_log').insert({
+                project_id: binding.projectId, actor_type: 'user', actor_id: binding.userId,
+                action: 'approval.submitted', resource_type: 'approval', resource_id: binding.approvalId,
+                details: { status: response.decision === 'approve' ? 'approved' : 'rejected', channel: binding.channel,
+                    connection_id: binding.connectionId, interaction_id: interactionId, payload_hash: data.payload_hash },
+            });
+            if (auditError)
+                throw new Error('Approval recorded, but decision audit failed');
+            return true;
+        },
+    };
+}

package/build/lib/approval-snapshot.d.ts

@@ -0,0 +1,5 @@
+type Params = Record<string, any>;
+/** Server-owned display facts, saved inside the hash-bound params. Never supplied by a tool. */
+export declare function captureApprovalSnapshot(action: string, params: Params, projectId: string): Promise<Params>;
+export declare function withoutApprovalSnapshot(params: unknown): Record<string, unknown>;
+export {};

package/build/lib/approval-snapshot.js

@@ -0,0 +1,106 @@
+import { readAllRows, chunkIds, scopeSegmentRulesToSite } from '@sendinel/domain';
+import { db } from '../db.js';
+import { resolveSendAudience, resolveSegmentContactIds } from './send-audience.js';
+const TARGET_ACTIONS = new Set(['send_broadcast', 'broadcast_to_segment', 'launch_campaign', 'activate_campaigns',
+    'update_campaign_status', 'set_campaign_trigger', 'create_campaign_with_content', 'enroll_segment',
+    'send_transactional', 'send_awaiting_reply', 'send_test_email', 'send_newsletter_issue', 'schedule_newsletter_issue']);
+/** Server-owned display facts, saved inside the hash-bound params. Never supplied by a tool. */
+export async function captureApprovalSnapshot(action, params, projectId) {
+    const snapshot = { version: 1, campaigns: [], steps: [], sites: [], recipient_count: null };
+    if (!TARGET_ACTIONS.has(action))
+        return snapshot;
+    const source = db();
+    const client = typeof source.schema === 'function' ? source.schema('email') : source;
+    const body = params.payload ?? params;
+    const ids = [...new Set((Array.isArray(params.campaign_ids) ? params.campaign_ids :
+            typeof params.campaign_id === 'string' ? [params.campaign_id] : []).map(String))].sort();
+    if (ids.length) {
+        snapshot.campaigns = await readAllRows(client.from('campaigns')
+            .select('id, name, site_id, type, status, trigger_event_name, trigger_tag, trigger_type, trigger_config, send_class, total_enrolled')
+            .eq('project_id', projectId).in('id', ids));
+        if (snapshot.campaigns.length !== ids.length)
+            throw new Error('Approval target not found');
+        snapshot.steps = await readAllRows(client.from('campaign_steps')
+            .select('id, campaign_id, step_order, variant_label, subject, body_html, body_text, delay_days, delay_hours, blocks')
+            .in('campaign_id', ids));
+        let count = 0;
+        for (const id of ids) {
+            const result = await client.from('campaign_enrollments').select('id', { count: 'exact', head: true }).eq('campaign_id', id);
+            if (result.error || result.count == null)
+                throw new Error('Approval audience count unavailable');
+            count += result.count;
+        }
+        snapshot.recipient_count = count;
+    }
+    if (typeof params.issue_id === 'string') {
+        const issue = await client.from('newsletter_issues').select('id, newsletter_id, subject, content, preheader, status, scheduled_at')
+            .eq('id', params.issue_id).eq('newsletter_id', params.newsletter_id).eq('project_id', projectId).maybeSingle();
+        const newsletter = await client.from('newsletters').select('id, name, site_id, status, sender_name, sender_email')
+            .eq('id', params.newsletter_id).eq('project_id', projectId).maybeSingle();
+        if (issue.error || !issue.data || newsletter.error || !newsletter.data)
+            throw new Error('Approval newsletter unavailable');
+        snapshot.issue = issue.data;
+        snapshot.newsletter = newsletter.data;
+        snapshot.subscriptions = await readAllRows(client.from('newsletter_subscriptions').select('id, subscriber_id')
+            .eq('newsletter_id', params.newsletter_id).eq('project_id', projectId).eq('status', 'active').not('subscriber_id', 'is', null));
+        snapshot.subscriptions.sort((a, b) => String(a.id).localeCompare(String(b.id)));
+        snapshot.recipient_count = snapshot.subscriptions.length;
+    }
+    const siteIds = [...new Set([body.site_id, snapshot.newsletter?.site_id, ...snapshot.campaigns.map((c) => c.site_id)]
+            .filter((id) => typeof id === 'string' && id.length > 0))].sort();
+    for (const id of siteIds) {
+        const { data, error } = await client.from('sites')
+            .select('id, name, from_name, from_email, sending_domain, physical_address, unsub_link_enabled, unsub_footer_template')
+            .eq('id', id).eq('project_id', projectId).maybeSingle();
+        if (error || !data)
+            throw new Error('Approval sender/footer unavailable');
+        snapshot.sites.push(data);
+    }
+    async function readFrozenContacts(contacts) {
+        const found = [];
+        for (const chunk of chunkIds([...new Set(contacts.map(String))])) {
+            const values = await readAllRows(client.from('subscribers').select('id')
+                .eq('project_id', projectId).in('id', chunk));
+            found.push(...values.map(value => value.id));
+        }
+        if (found.length !== new Set(contacts).size)
+            throw new Error('Approval recipients changed or unavailable');
+        return found.sort();
+    }
+    if (typeof body.segment_id === 'string') {
+        const { data, error } = await client.from('segments').select('id, name, rules, site_id')
+            .eq('id', body.segment_id).eq('project_id', projectId).maybeSingle();
+        if (error || !data)
+            throw new Error('Approval segment unavailable');
+        snapshot.segment = data;
+        // launch_campaign executes a frozen list, so new segment matches cannot expand its audience.
+        // The saved segment definition is still compared; deleted original recipients invalidate it.
+        const rules = scopeSegmentRulesToSite(data.rules, data.site_id);
+        snapshot.contact_ids = action === 'launch_campaign' && Array.isArray(params.generated?.contact_ids)
+            ? await readFrozenContacts(params.generated.contact_ids)
+            : typeof body.site_id === 'string'
+                ? (await resolveSendAudience(projectId, body.site_id, rules, body.send_class === 'product' ? 'product' : 'broadcast')).contactIds.sort()
+                : (await resolveSegmentContactIds(projectId, rules)).sort();
+        snapshot.recipient_count = snapshot.contact_ids.length;
+    }
+    else if (body.rules && typeof body.site_id === 'string') {
+        snapshot.contact_ids = (await resolveSendAudience(projectId, body.site_id, body.rules, body.send_class === 'product' ? 'product' : 'broadcast')).contactIds.sort();
+        snapshot.recipient_count = snapshot.contact_ids.length;
+    }
+    else {
+        const contacts = body.contact_ids ?? params.generated?.contact_ids;
+        if (Array.isArray(contacts)) {
+            snapshot.contact_ids = await readFrozenContacts(contacts);
+            snapshot.recipient_count = snapshot.contact_ids.length;
+        }
+        else if (typeof body.to === 'string')
+            snapshot.recipient_count = 1;
+    }
+    snapshot.campaigns.sort((a, b) => String(a.id).localeCompare(String(b.id)));
+    snapshot.steps.sort((a, b) => String(a.id).localeCompare(String(b.id)));
+    return snapshot;
+}
+export function withoutApprovalSnapshot(params) {
+    const { __approval_snapshot: _snapshot, ...rest } = (params ?? {});
+    return rest;
+}

package/build/server.js

@@ -1,3 +1,4 @@
+import { installApprovalCapabilityProbe } from './lib/approval-capabilities.js';
 import { runWithToolContext } from './db.js';
 import { isApprovalGatedAction } from './lib/action-approvals.js';
 import { registerAgentMailboxTools } from './tools/agent-mailboxes.js';
@@ -377,6 +378,8 @@ export const SENDINEL_SERVER_INSTRUCTIONS = [
     'On the hosted connection, any tool call (and invoke_tool) also accepts an optional project_id to act on one project for that call only; it is checked each time, and approval-gated tools require it when the connection was switched to another project. In gateway mode, find tools with search_tools (plain words work, for example "send email" or "last campaign"), check arguments with describe_tool, then call invoke_tool.',
 ].join(' ');
 export function registerAllTools(server, options) {
+    if (server.server)
+        installApprovalCapabilityProbe(server.server);
     const rawScopes = options?.scopes ?? [];
     if (rawScopes.includes('gateway')) {
         const permissionScopes = rawScopes.filter((scope) => scope !== 'gateway');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.104",
+  "version": "1.0.105",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",