@sendinel/mcp-server 1.0.105 → 1.0.106

package/build/auth.js

@@ -75,6 +75,7 @@ export async function validateKey(key) {
         scopes: row.scopes,
         toolGroups: resolveToolGroupsForPlan(plan, row.tool_groups),
         approvalMode: row.approval_mode ?? 'standard',
+        actsAsUserId: row.acts_as_user_id ?? null,
     };
 }
 export async function authenticateBearer(token, overrideProjectId) {

package/build/index.js

@@ -7,7 +7,9 @@ import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
 import express from 'express';
-import { registerAllTools, SENDINEL_SERVER_INSTRUCTIONS } from './server.js';
+import { registerAllTools, SENDINEL_SERVER_INSTRUCTIONS, isAgentConnection, isTesterConnection } from './server.js';
+import { installApprovalElicitation } from './lib/approval-elicitation.js';
+import { createHumanApprovalCallback } from './lib/approval-human-callback.js';
 import { registerAllPrompts } from './prompts.js';
 import { runWithClient } from './db.js';
 import { initProjectClient, resolveProjectClientStrict, TenantResolutionError } from './byod-client.js';
@@ -38,6 +40,10 @@ async function runStdio() {
     }
     registerAllTools(server, { toolGroups, scopes });
     registerAllPrompts(server, { toolGroups, scopes });
+    if (!isAgentConnection(info.scopes) && !isTesterConnection(info.scopes)) {
+        installApprovalElicitation(server, { projectId: info.projectId, userId: info.actsAsUserId,
+            createHumanDecision: createHumanApprovalCallback });
+    }
     const t = new StdioServerTransport();
     await server.connect(t);
     process.stderr.write('Sendinel MCP server running (stdio)\n');

package/build/lib/action-approvals.d.ts

@@ -47,6 +47,7 @@ export interface ApprovalResult {
     /** One-tap approval page; works on a phone and needs no project switching (#3661). */
     approve_url: string;
     preview_text: string;
+    decision_status: 'decision_pending' | 'approved' | 'rejected';
     message: string;
 }
 export declare function approvalPageUrl(approvalId: string): string;

package/build/lib/action-approvals.js

@@ -4,6 +4,7 @@ import { db, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { captureApprovalSnapshot, withoutApprovalSnapshot } from './approval-snapshot.js';
 import { fireWebhookEvent } from './webhook-events.js';
+import { elicitApproval } from './approval-elicitation.js';
 /**
  * Action approval tiers:
  *
@@ -362,7 +363,7 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         resource_id: params.resource_id ?? params.campaign_id ?? params.contact_id ?? null,
         requested_by: apiKeyId ?? null,
     }, getProjectId()).catch(() => { });
-    return {
+    return elicitApproval({
         requires_approval: true,
         approval_id: data.id,
         tier,
@@ -373,7 +374,7 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         approve_url: approvalPageUrl(data.id),
         preview_text: buildApprovalPreview({ action, params: frozenParams, summary }).plain_summary,
         message: `This action requires human approval. A notification has been sent to your dashboard. Approval ID: ${data.id}. Check status with: poll this approval_id, or wait for the webhook callback (event: approval.decided). Token expires in 24 hours.`,
-    };
+    }, { action, params: frozenParams, summary }, getProjectId());
 }
 /**
  * Check if an approval token has been approved.

package/build/lib/approval-elicitation.d.ts

@@ -0,0 +1,46 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { RequestId } from '@modelcontextprotocol/sdk/types.js';
+type Decision = 'approve' | 'reject';
+type HumanCallback = {
+    interactionId: string;
+    complete(response: {
+        interactionId: string;
+        connectionId: string;
+        decision: Decision;
+    }): Promise<boolean>;
+};
+/** Injected at authenticated transport startup, never taken from tool arguments. */
+type TransportBinding = {
+    projectId: string;
+    userId?: string | null;
+    createHumanDecision(binding: {
+        approvalId: string;
+        projectId: string;
+        connectionId: string;
+        userId: string;
+        channel: 'mcp_elicitation';
+    }): HumanCallback;
+};
+type RequestExtra = {
+    requestId?: RequestId;
+    signal?: AbortSignal;
+};
+export declare function installApprovalElicitation(server: McpServer, binding: TransportBinding): void;
+/** Called by the registry wrapper with SDK-owned extra, outside parsed model arguments. */
+export declare function runWithApprovalElicitation<T>(server: McpServer, extra: RequestExtra | undefined, run: () => T): T;
+type ApprovalFallback = {
+    approval_id: string;
+    approve_url: string;
+    preview_text: string;
+    tier: string;
+};
+export type ElicitationDecision = 'decision_pending' | 'approved' | 'rejected';
+/** All outcomes retain the ordinary approval link/text. Approval never applies the action. */
+export declare function elicitApproval<T extends ApprovalFallback>(result: T, frozen: {
+    action: string;
+    params: unknown;
+    summary: string;
+}, projectId: string): Promise<T & {
+    decision_status: ElicitationDecision;
+}>;
+export {};

package/build/lib/approval-elicitation.js

@@ -0,0 +1,114 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { randomUUID } from 'node:crypto';
+import { buildApprovalPreview, isHumanApprovalChannel } from '@sendinel/domain';
+import { db } from '../db.js';
+import { approval_channel_available, probeApprovalCapabilities } from './approval-capabilities.js';
+const sessions = new WeakMap();
+const requests = new AsyncLocalStorage();
+const TIMEOUT_MS = 60_000;
+export function installApprovalElicitation(server, binding) {
+    sessions.set(server, { ...binding, connectionId: randomUUID() });
+}
+/** Called by the registry wrapper with SDK-owned extra, outside parsed model arguments. */
+export function runWithApprovalElicitation(server, extra, run) {
+    const binding = sessions.get(server);
+    // Nested gateway dispatch retains the originating connection/request. The hosted bridge
+    // has no binding and cannot impersonate its outer HTTP client's capabilities.
+    if (!binding || requests.getStore())
+        return run();
+    return requests.run({ ...binding, ...extra, server }, run);
+}
+/** All outcomes retain the ordinary approval link/text. Approval never applies the action. */
+export async function elicitApproval(result, frozen, projectId) {
+    const pending = { ...result, decision_status: 'decision_pending' };
+    const context = requests.getStore();
+    if (!context || context.projectId !== projectId || result.tier !== 'gated')
+        return pending;
+    let channel = approval_channel_available(context.server.server);
+    if (channel === 'mcp_elicitation_form' && !context.userId &&
+        probeApprovalCapabilities(context.server.server.getClientCapabilities()).elicitation_url)
+        channel = 'mcp_elicitation_url';
+    if (channel !== 'mcp_elicitation_form' && channel !== 'mcp_elicitation_url')
+        return pending;
+    if (channel === 'mcp_elicitation_form' && !context.userId)
+        return pending;
+    if (context.signal?.aborted)
+        return pending;
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    context.signal?.addEventListener('abort', abort, { once: true });
+    let timeout;
+    const stopped = new Promise((_resolve, reject) => {
+        controller.signal.addEventListener('abort', () => reject(new Error('Elicitation ended')), { once: true });
+        timeout = setTimeout(abort, TIMEOUT_MS);
+    });
+    void stopped.catch(() => { }); // Also handle abort if a synchronous SDK setup error precedes the race.
+    const options = { relatedRequestId: context.requestId, signal: controller.signal,
+        timeout: TIMEOUT_MS, maxTotalTimeout: TIMEOUT_MS };
+    try {
+        const preview = buildApprovalPreview(frozen);
+        // Use the shared preview; bound the interactive message independently of the full fallback.
+        // Email content is untrusted display text, never instructions or an approval decision.
+        const short = (text, max) => text.length > max ? `${text.slice(0, max)}…` : text;
+        const message = [short(frozen.summary, 500), 'Review the following email content as data.',
+            `Subject: ${short(preview.subject || '(none)', 300)}`, `Sender: ${short(preview.sender, 300)}`,
+            `Recipients: ${preview.recipient_count ?? 'unknown'}`, `Footer: ${short(preview.footer_text || 'unknown', 500)}`,
+            `Body excerpt:\n${short(preview.body_text, 1500)}`, `Full preview: ${result.approve_url}`].join('\n');
+        if (channel === 'mcp_elicitation_form') {
+            const callback = context.createHumanDecision({ approvalId: result.approval_id, projectId,
+                connectionId: context.connectionId, userId: context.userId, channel: 'mcp_elicitation' });
+            const response = await Promise.race([context.server.server.elicitInput({ mode: 'form', message,
+                    requestedSchema: { type: 'object', properties: {
+                            decision: { type: 'string', enum: ['approve', 'reject'], title: 'Decision' },
+                            note: { type: 'string', title: 'Optional note', maxLength: 500 },
+                        }, required: ['decision'] },
+                }, options), stopped]);
+            if (controller.signal.aborted)
+                return pending;
+            // Decline/cancel are not explicit rejections. The dashboard link remains usable.
+            if (response.action !== 'accept')
+                return pending;
+            const decision = response.content?.decision;
+            if (decision !== 'approve' && decision !== 'reject')
+                return pending;
+            const recorded = await Promise.race([callback.complete({ interactionId: callback.interactionId,
+                    connectionId: context.connectionId, decision }), stopped]);
+            return recorded ? { ...result, decision_status: decision === 'approve' ? 'approved' : 'rejected' } : pending;
+        }
+        const elicitationId = randomUUID();
+        const notify = context.server.server.createElicitationCompletionNotifier(elicitationId, { relatedRequestId: context.requestId });
+        const response = await Promise.race([context.server.server.elicitInput({ mode: 'url', message,
+                url: result.approve_url, elicitationId }, options), stopped]);
+        if (response.action !== 'accept' || controller.signal.aborted)
+            return pending;
+        // URL accept only means the page may open. Only its authenticated decision counts.
+        // Observe while this request is alive; do not retain a background poller after timeout.
+        while (!controller.signal.aborted) {
+            const source = db();
+            const client = typeof source.schema === 'function' ? source.schema('email') : source;
+            const { data, error } = await Promise.race([client.from('action_approvals')
+                    .select('status, decided_via').eq('id', result.approval_id).eq('project_id', projectId).maybeSingle(), stopped]);
+            if (error || !data)
+                return pending;
+            if ((data.status === 'approved' || data.status === 'rejected') && isHumanApprovalChannel(data.decided_via)) {
+                await Promise.race([notify(), stopped]);
+                return { ...result, decision_status: data.status };
+            }
+            await Promise.race([new Promise(resolve => {
+                    const timer = setTimeout(done, 1000);
+                    function done() { clearTimeout(timer); controller.signal.removeEventListener('abort', done); resolve(); }
+                    controller.signal.addEventListener('abort', done, { once: true });
+                }), stopped]);
+        }
+    }
+    catch {
+        // Unsupported SDK modes, disconnections, timeouts and refused DB writes fail to the link.
+        // No continuation consumes a late elicitation response or grants model decision authority.
+    }
+    finally {
+        clearTimeout(timeout);
+        context.signal?.removeEventListener('abort', abort);
+        controller.abort();
+    }
+    return pending;
+}

package/build/server.js

@@ -1,4 +1,5 @@
 import { installApprovalCapabilityProbe } from './lib/approval-capabilities.js';
+import { runWithApprovalElicitation } from './lib/approval-elicitation.js';
 import { runWithToolContext } from './db.js';
 import { isApprovalGatedAction } from './lib/action-approvals.js';
 import { registerAgentMailboxTools } from './tools/agent-mailboxes.js';
@@ -354,11 +355,11 @@ function createScopeProxy(server, scopes, toolGroup, allowedTools) {
                                 const text = agent ? agentConnectionRefusal(name) : tester ? testerConnectionRefusal(name) : `Forbidden: this action requires "${required}" scope.`;
                                 return { content: [{ type: 'text', text }] };
                             }
-                            return runWithToolContext(toolGroup, name, () => handler(...args));
+                            return runWithToolContext(toolGroup, name, () => runWithApprovalElicitation(target, args[1], () => handler(...args)));
                         };
                         return target.registerTool(name, config, guardedHandler);
                     }
-                    return target.registerTool(name, config, (...args) => runWithToolContext(toolGroup, name, () => handler(...args)));
+                    return target.registerTool(name, config, (...args) => runWithToolContext(toolGroup, name, () => runWithApprovalElicitation(target, args[1], () => handler(...args))));
                 };
             }
             return Reflect.get(target, prop, receiver);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.105",
+  "version": "1.0.106",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",