@sendinel/mcp-server 1.0.142 → 1.0.144

package/README.md

@@ -18,7 +18,7 @@ preserves REST outcomes, and redacts failures. See the
 [event-triggered campaign guide](../../docs/event-triggered-campaigns.md) for
 inputs, idempotency, subscription requirements, and conditional step examples.
 
-Sendinel currently exposes 35 tool groups and 344 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
+Sendinel currently exposes 35 tool groups and 346 tools (gateway mode exposes 4 meta-tools, sharing how_to with full mode). These counts are checked against the tool registry in CI, so this table matches what ships.
 
 | Group | Count | Purpose |
 |-------|-------|---------|
@@ -27,7 +27,7 @@ Sendinel currently exposes 35 tool groups and 344 tools (gateway mode exposes 4
 | `advisor` | 6 | Campaign advisor: recommendations, benchmarks, subject/content/send-time guidance |
 | `ai-work` | 9 | AI work items, recommended segments, context events, agent proposals |
 | `analytics` | 15 | Stats, portfolio analytics, project switching, domain health, engagement, deliverability, revenue analytics |
-| `approvals` | 3 | Poll and list risk-tiered action approvals |
+| `approvals` | 5 | Poll/list approvals, person OAuth approval, write-scoped cancellation, opted-in chat confirmation |
 | `automations` | 7 | Automation triggers, previews, and response-gated escalation ladders |
 | `brand_kit` | 6 | Brand Core text import, media library upload/URL ingest, asset-context reads, project logo selection |
 | `campaigns` | 44 | Full campaign lifecycle: create, edit, approve, launch, enroll, schedule, sequence templates, convert imported campaigns |
@@ -58,6 +58,14 @@ Sendinel currently exposes 35 tool groups and 344 tools (gateway mode exposes 4
 | `warmup` | 4 | IP/domain warmup schedule control |
 | `webhooks` | 5 | Webhook subscription management |
 
+`cancel_approval({approval_id})` rejects an unexpired, unused pending/approved
+request in the current project for any write-scoped credential.
+`approve_approval({approval_id})` requires the person's own live OAuth connection
+(`connection_role: NULL`) and its own pending request in that project. Tester,
+agent, API key, service-token and scoped-JWT credentials cannot approve. Sends
+and deletes still need approval; the user may answer through their AI without
+another verification prompt. See [approval tools](../../docs/mcp-tools.md#approve_approval).
+
 ## Install / run
 
 ```bash

package/build/lib/action-approvals.d.ts

@@ -50,6 +50,8 @@ export interface ApprovalResult {
     summary: string;
     expires_at: string;
     approve_via: string;
+    decided_via?: 'sandbox';
+    decided_by?: null;
     /** One-tap approval page; works on a phone and needs no project switching (#3661). */
     approve_url: string;
     preview_text: string;

package/build/lib/action-approvals.js

@@ -137,7 +137,7 @@ export function approvalExcerpt(html, max = 200) {
 function broadcastSummary(d) {
     if (!d.subject)
         return null;
-    const count = typeof d.recipient_count === 'number' ? `${d.recipient_count.toLocaleString('en-US')} recipient${d.recipient_count === 1 ? '' : 's'}` : null;
+    const count = typeof d.recipient_count === 'number' ? `${d.recipient_count.toLocaleString('en-US')} recipient${d.recipient_count === 1 ? '' : 's'}` : d.recipient_count === null ? 'unknown recipients' : null;
     const audience = d.segment_name ? `segment "${d.segment_name}"` : (d.audience_label ? String(d.audience_label) : 'the chosen audience');
     const when = d.send_at ? ` at ${d.send_at}` : '';
     const excerpt = d.body_excerpt ? ` — "${d.body_excerpt}"` : '';
@@ -323,11 +323,13 @@ export async function requestApproval(action, params, apiKeyId, channelContext,
         }
         catch { /* Missing display data omits the project line. */ }
     const approveUrl = approvalPageUrl(data.id);
-    const previewText = buildApprovalPreview({ action, params: frozenParams, summary, projectName }).plain_summary;
+    const previewText = buildApprovalPreview({ action, params: frozenParams, summary, projectName, ...(display && 'recipient_count' in display ? { recipientCount: display.recipient_count } : {}) }).plain_summary;
     if (sandboxApproved) {
         return { requires_approval: true, approval_id: data.id, tier, action, summary, expires_at: expiresAt,
-            approve_via: 'sandbox', approve_url: approveUrl, preview_text: previewText, decision_status: 'approved',
-            message: 'Sandbox project: approved automatically\nCall this tool again with the same arguments plus approval_id to run it.' };
+            approve_via: 'sandbox', decided_via: 'sandbox', decided_by: null, approve_url: approveUrl, preview_text: previewText, decision_status: 'approved',
+            message: action === 'send_broadcast'
+                ? 'Sandbox project: approved automatically (no person decided it). Call send_broadcast again with only approval_id to send.'
+                : 'Sandbox project: approved automatically\nCall this tool again with the same arguments plus approval_id to run it.' };
     }
     const chatGuidance = tier === 'gated' && await humanApprovalEligible(action, getProjectId(), actor, true)
         ? `\nAsk the user in plain chat: "${previewText.split('\n')[0].trim()}". Only after they say yes, call confirm_approval with approval_id, action, echo (the first line of preview_text) and user_reply (their exact words), then call the original tool again with approval_id.`
@@ -403,10 +405,10 @@ export async function checkApproval(approvalId, options = {}) {
     }
     if (data.used_at || data.status === 'used')
         return { approved: false, status: 'consumed' };
-    // Chat decisions stay bound to the same live human grant at consumption, for every action.
-    if (data.status === 'approved' && data.decided_via === 'chat_confirm' &&
+    // Tool decisions stay bound to the same live human grant at consumption, for every action.
+    if (data.status === 'approved' && ['chat_confirm', 'mcp_person'].includes(data.decided_via) &&
         (requestContext()?.oauthTokenId !== data.oauth_token_id || requestContext()?.actorId !== data.decided_by ||
-            !await humanApprovalEligible(data.action, getProjectId(), requestContext(), true))) {
+            !await humanApprovalEligible(data.action, getProjectId(), requestContext(), data.decided_via === 'chat_confirm'))) {
         return { approved: false, status: 'human_decision_required' };
     }
     const sandboxDecision = data.decided_via === 'sandbox';
@@ -416,7 +418,7 @@ export async function checkApproval(approvalId, options = {}) {
     }
     if (data.status === 'approved' && !sandboxDecision && (!isHumanApprovalChannel(data.decided_via) ||
         (isHumanRequestableAdminTool(data.action) && data.decided_via !== 'dashboard' &&
-            (!['mcp_app', 'mcp_elicitation', 'chat_confirm'].includes(data.decided_via) ||
+            (!['mcp_app', 'mcp_elicitation', 'chat_confirm', 'mcp_person'].includes(data.decided_via) ||
                 !await humanApprovalEligible(data.action, getProjectId(), { projectId: getProjectId(),
                     actorId: data.decided_by, oauthTokenId: data.oauth_token_id, authKind: 'oauth', channelVerified: true }))))) {
         return { approved: false, status: 'human_decision_required' };
@@ -457,7 +459,7 @@ export async function checkApproval(approvalId, options = {}) {
         .eq('decided_via', data.decided_via)
         .eq('params', JSON.stringify(data.params))
         .gt('requested_at', new Date(Date.now() - 24 * 60 * 60 * 1000).toISOString());
-    if (data.decided_via === 'chat_confirm')
+    if (['chat_confirm', 'mcp_person'].includes(data.decided_via))
         claimQuery.eq('oauth_token_id', requestContext().oauthTokenId).eq('decided_by', requestContext().actorId);
     const boundClaim = data.payload_hash ? claimQuery.eq('payload_hash', data.payload_hash) : claimQuery.is('payload_hash', null);
     const { data: claimed, error: claimError } = await boundClaim.select('decided_by').maybeSingle();

package/build/lib/approval-exempt.js

@@ -20,8 +20,10 @@ export const APPROVAL_EXEMPT = {
     add_suppression: "only stops mail to an address; reduces sending",
     add_synced_folder: "starts syncing a Drive folder into the project own media library; inbound only",
     add_white_label_domain: "adds a pending branding domain record; reversible and sends nothing",
+    approve_approval: "is the approval step itself: only a person-role OAuth connection can decide its own pending request, bound to that token and project, audited; sends nothing",
     approve_data_proposal: "turns a proposal into an AI draft for review; sends nothing",
     approve_draft: "marks a draft ready; sending still requires a gated send or activation",
+    cancel_approval: "only moves an unused approval to rejected (never grants anything); reduces what can run",
     cancel_send_queue_rows: "cancels queued mail before it sends; reduces sending",
     clone_campaign: "creates a draft copy of a campaign; nothing sends until activated (gated)",
     clone_sequence_template: "creates a draft campaign from a template; nothing sends until activated (gated)",

package/build/lib/approval-tool-decisions.d.ts

@@ -0,0 +1,15 @@
+export declare function cancelApproval(approvalId: string, transportClientName?: string): Promise<{
+    code: string;
+    error: string;
+} | {
+    approval_id: string;
+    status: 'rejected';
+}>;
+export declare function approveApproval(approvalId: string, transportClientName?: string): Promise<{
+    code: string;
+    error: string;
+} | {
+    approval_id: string;
+    decision_status: 'approved';
+    next: string;
+}>;

package/build/lib/approval-tool-decisions.js

@@ -0,0 +1,103 @@
+import { requestContext } from '../db.js';
+import { getProjectId } from '../project.js';
+import { humanApprovalEligible } from './approval-human-eligibility.js';
+import { approvalStore } from './tester-requests-store.js';
+const refuse = (code, error) => ({ code, error });
+const store = () => approvalStore().schema('email');
+/** OAuth names come from the registered client, never a model-supplied argument. */
+async function clientName(fallback) {
+    const actor = requestContext();
+    if (!actor?.oauthTokenId)
+        return fallback ?? actor?.agentLabel ?? null;
+    const client = store();
+    const { data: grant, error: grantError } = await client.from('mcp_oauth_tokens')
+        .select('client_id').eq('id', actor.oauthTokenId).maybeSingle();
+    if (grantError || !grant?.client_id)
+        throw new Error('Unable to identify the OAuth client');
+    const { data, error } = await client.from('mcp_oauth_clients')
+        .select('client_name').eq('client_id', grant.client_id).maybeSingle();
+    if (error || typeof data?.client_name !== 'string')
+        throw new Error('Unable to identify the OAuth client');
+    return data.client_name;
+}
+export async function cancelApproval(approvalId, transportClientName) {
+    const actor = requestContext();
+    if (!actor?.scopes?.some(scope => scope === 'write' || scope === 'admin')) {
+        return refuse('approval_forbidden', 'Cancelling an approval requires write scope.');
+    }
+    try {
+        const projectId = getProjectId();
+        const name = await clientName(transportClientName);
+        const now = new Date().toISOString();
+        // A single conditional write arbitrates cancellation versus approval/consumption.
+        // Preserve the original decision provenance; cancellation never grants authority.
+        const { data, error } = await store().from('action_approvals')
+            .update({ status: 'rejected' })
+            .eq('id', approvalId).eq('project_id', projectId)
+            .in('status', ['pending', 'approved']).is('used_at', null).gt('expires_at', now)
+            .select('id').maybeSingle();
+        if (error)
+            return refuse('approval_update_failed', 'Unable to cancel the approval. Check its status before retrying.');
+        if (!data)
+            return refuse('approval_not_cancellable', 'No unexpired, unused pending or approved approval found in this project.');
+        const { error: auditError } = await store().from('audit_log').insert({
+            project_id: projectId, actor_type: actor.actorType ?? actor.authKind ?? 'api_key',
+            actor_id: actor.actorId ?? actor.keyId ?? actor.oauthTokenId ?? null,
+            action: 'approval.cancelled', resource_type: 'approval', resource_id: approvalId,
+            details: { status: 'rejected', client_name: name, auth_kind: actor.authKind ?? null,
+                oauth_token_id: actor.oauthTokenId ?? null, api_key_id: actor.keyId ?? null },
+        });
+        if (auditError)
+            return refuse('approval_audit_failed', 'Approval cancelled, but audit failed. Check its status before retrying.');
+        return { approval_id: approvalId, status: 'rejected' };
+    }
+    catch {
+        return refuse('approval_failed', 'Cancellation failed. Check approval status before retrying.');
+    }
+}
+export async function approveApproval(approvalId, transportClientName) {
+    const actor = requestContext();
+    const projectId = getProjectId();
+    // Reuse the same live-grant identification as the app/elicitation path (#4312).
+    if (!await humanApprovalEligible('approve_approval', projectId, actor)) {
+        return refuse('approval_forbidden', 'Approval requires your own verified person-role OAuth connection in this project.');
+    }
+    try {
+        const client = store();
+        const { data: approval, error: loadError } = await client.from('action_approvals')
+            .select('action, params, payload_hash')
+            .eq('id', approvalId).eq('project_id', projectId).eq('oauth_token_id', actor.oauthTokenId)
+            .eq('status', 'pending').is('used_at', null).gt('expires_at', new Date().toISOString()).maybeSingle();
+        if (loadError)
+            return refuse('approval_lookup_failed', 'Unable to verify the approval. Nothing was recorded.');
+        if (!approval)
+            return refuse('approval_not_pending', 'No unexpired, unused pending approval found for this connection and project.');
+        if (!await humanApprovalEligible(approval.action, projectId, actor)) {
+            return refuse('approval_forbidden', 'This approval requires a person with the required project role.');
+        }
+        const name = await clientName(transportClientName);
+        const now = new Date().toISOString();
+        const decision = client.from('action_approvals')
+            .update({ status: 'approved', decided_via: 'mcp_person', decided_by: actor.actorId, decided_at: now })
+            .eq('id', approvalId).eq('project_id', projectId).eq('oauth_token_id', actor.oauthTokenId)
+            .eq('action', approval.action).eq('status', 'pending').is('used_at', null).gt('expires_at', now)
+            .eq('params', JSON.stringify(approval.params));
+        const bound = approval.payload_hash == null ? decision.is('payload_hash', null) : decision.eq('payload_hash', approval.payload_hash);
+        const { data, error } = await bound.select('id, payload_hash').maybeSingle();
+        if (error || !data)
+            return refuse('approval_not_pending', 'Approval is already decided, used or no longer valid. Request a new approval.');
+        const { error: auditError } = await client.from('audit_log').insert({
+            project_id: projectId, actor_type: 'user', actor_id: actor.actorId,
+            action: 'approval.submitted', resource_type: 'approval', resource_id: approvalId,
+            details: { status: 'approved', channel: 'mcp_person', client_name: name,
+                connection_id: `oauth:${actor.oauthTokenId}`, payload_hash: data.payload_hash },
+        });
+        if (auditError)
+            return refuse('approval_audit_failed', 'Approval recorded, but audit failed. Check its status before retrying.');
+        return { approval_id: approvalId, decision_status: 'approved',
+            next: `Call ${approval.action} again with the same arguments plus approval_id.` };
+    }
+    catch {
+        return refuse('approval_failed', 'Approval failed. Check approval status before retrying.');
+    }
+}

package/build/lib/sandbox-audience.d.ts

@@ -0,0 +1,30 @@
+/** Display only: never narrow or otherwise change the frozen enrollment payload. */
+export declare function sandboxAudience(projectId: string, contactIds: string[]): Promise<{
+    recipient_count: number;
+    audience_matched_count?: undefined;
+    sandbox?: undefined;
+} | {
+    recipient_count: number;
+    audience_matched_count: number;
+    sandbox: {
+        active: true;
+        allowed_domains: string[] | null;
+        filtered_out: number;
+        count_unknown?: undefined;
+    };
+} | {
+    recipient_count: null;
+    audience_matched_count: number;
+    sandbox: {
+        active: boolean | null;
+        allowed_domains: string[] | null;
+        filtered_out: null;
+        count_unknown: boolean;
+    };
+}>;
+export declare function broadcastApprovalNext(approval: {
+    approve_via?: string;
+    decision_status?: string;
+}, sandbox?: {
+    allowed_domains: string[] | null;
+}): string;

package/build/lib/sandbox-audience.js

@@ -0,0 +1,48 @@
+import { chunkIds, isSandboxDomain, matchSandboxDomains, readAllRows } from '@sendinel/domain';
+import { adminDb, db } from '../db.js';
+/** Display only: never narrow or otherwise change the frozen enrollment payload. */
+export async function sandboxAudience(projectId, contactIds) {
+    let active = null;
+    let allowedDomains = null;
+    try {
+        const { data, error } = await adminDb().schema('email').from('projects')
+            .select('sandbox_mode, sandbox_allowed_domains').eq('id', projectId).maybeSingle();
+        if (error || !data || typeof data.sandbox_mode !== 'boolean')
+            throw new Error('Sandbox policy unavailable');
+        active = data.sandbox_mode;
+        if (!active)
+            return { recipient_count: contactIds.length };
+        if (!Array.isArray(data.sandbox_allowed_domains) || !data.sandbox_allowed_domains.every(isSandboxDomain)) {
+            throw new Error('Sandbox domains unavailable');
+        }
+        allowedDomains = data.sandbox_allowed_domains;
+        const emails = new Map();
+        for (const chunk of chunkIds(contactIds)) {
+            const rows = await readAllRows(db().schema('email').from('subscribers').select('id, email').eq('project_id', projectId).in('id', chunk));
+            for (const row of rows) {
+                if (typeof row.email !== 'string')
+                    throw new Error('Contact email unavailable');
+                emails.set(row.id, row.email);
+            }
+        }
+        if (contactIds.some(id => !emails.has(id)))
+            throw new Error('Contact lookup incomplete');
+        const count = contactIds.filter(id => !matchSandboxDomains(allowedDomains, { to: emails.get(id) })).length;
+        return { recipient_count: count, audience_matched_count: contactIds.length,
+            sandbox: { active, allowed_domains: allowedDomains, filtered_out: contactIds.length - count } };
+    }
+    catch {
+        return { recipient_count: null, audience_matched_count: contactIds.length,
+            sandbox: { active, allowed_domains: allowedDomains, filtered_out: null, count_unknown: true } };
+    }
+}
+export function broadcastApprovalNext(approval, sandbox) {
+    if (approval.approve_via === 'sandbox' && approval.decision_status === 'approved') {
+        const domains = sandbox?.allowed_domains;
+        return 'Sandbox project: this was approved automatically (no person decided it). Call send_broadcast again with only approval_id to send. ' +
+            (domains ? domains.length ? `Only recipients on ${domains.join(', ')} can be delivered, subject to send-time policy checks.` : 'No sandbox domains are allowed; no recipients can be delivered.'
+                : 'Sandbox domains could not be loaded; the deliverable recipient count is unknown.') +
+            ' Do not say it was sent before that call succeeds.';
+    }
+    return 'Show the user the subject, recipient count and approve_url. After a person approves, call send_broadcast with only approval_id. Do not say it was sent before that call succeeds.';
+}

package/build/server.js

@@ -87,6 +87,7 @@ export const ALL_TOOL_GROUPS = Object.keys(GROUP_REGISTRY);
 // ── Scope enforcement ─────────────────────────────────────────────────────
 // Maps tool names to required scope. Mirrors dashboard's WRITE_TOOLS/ADMIN_TOOLS.
 const WRITE_TOOLS = new Set([
+    'cancel_approval', 'approve_approval',
     'recheck_domain_dns',
     'mark_agent_message', 'draft_agent_reply', 'create_agent_mailbox',
     'add_subscriber', 'identify_subscriber', 'emit_contact_event', 'import_subscribers', 'update_subscriber', 'bulk_update_subscribers',
@@ -172,7 +173,7 @@ export function isAgentConnection(scopes) {
     return !!scopes?.includes(AGENT_CONNECTION_SCOPE);
 }
 export function agentConnectionAllowsTool(name) {
-    return ['list_agent_inbox', 'read_agent_message', 'get_agent_thread', 'mark_agent_message',
+    return ['cancel_approval', 'list_agent_inbox', 'read_agent_message', 'get_agent_thread', 'mark_agent_message',
         'draft_agent_reply', 'search_tools', 'describe_tool', 'invoke_tool'].includes(name);
 }
 export function agentConnectionRefusal(name) {
@@ -186,6 +187,7 @@ export function testerConnectionAllowsTool(name) {
     // Retain the existing campaign activation path. A globally gated tool is not by itself
     // permission for a tester: sends, deletes and access/infrastructure writes stay refused.
     return getRequiredScope(name) === 'read'
+        || name === 'cancel_approval'
         || TESTER_REQUEST_TOOLS.has(name)
         || name === 'activate_campaigns'
         || name === 'update_campaign_status';
@@ -321,7 +323,7 @@ function createScopeProxy(server, scopes, toolGroup, allowedTools) {
                         const required = getRequiredScope(name);
                         const tester = isTesterConnection(scopes);
                         const agent = isAgentConnection(scopes);
-                        const allowed = () => agent ? agentConnectionAllowsTool(name) : tester
+                        const allowed = () => name === 'cancel_approval' ? scopeAllows(scopes, 'write') : agent ? agentConnectionAllowsTool(name) : tester
                             ? testerConnectionAllowsTool(name)
                             : scopeAllows(scopes, required) || (scopeAllows(scopes, 'read') && isHumanRequestableAdminTool(name));
                         if (!allowed()) {

package/build/tools/approvals.js

@@ -4,9 +4,29 @@ import { getProjectId } from '../project.js';
 import { dbToolError, toolError } from '../lib/db-error.js';
 import { checkApproval } from '../lib/action-approvals.js';
 import { confirmApproval, confirmApprovalInput } from '../lib/approval-chat-confirm.js';
+import { approveApproval, cancelApproval } from '../lib/approval-tool-decisions.js';
+import { approvalClientName } from '../lib/approval-capabilities.js';
 const txt = (text) => ({ content: [{ type: 'text', text }] });
 const j = (data) => txt(JSON.stringify(data, null, 2));
 export function registerApprovalTools(server, options) {
+    server.registerTool('cancel_approval', {
+        title: 'Cancel Approval',
+        description: 'Cancel an unexpired, unused pending or approved action approval in this project. Requires write scope. Sets it to rejected; cannot approve or undo cancellation.',
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        inputSchema: { approval_id: z.string().uuid() },
+    }, async ({ approval_id }) => {
+        const result = await cancelApproval(approval_id, server.server && approvalClientName(server.server));
+        return { ...j(result), ...('code' in result ? { isError: true } : {}) };
+    });
+    server.registerTool('approve_approval', {
+        title: 'Approve Approval',
+        description: "Record the person's approval through their own OAuth connection for this project. Only person-role OAuth connections may approve their own pending, unexpired, unused requests. Tester, agent, API key, service token and scoped JWT credentials cannot approve. Call only when the person asks to approve; then retry the original action with approval_id.",
+        annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false },
+        inputSchema: { approval_id: z.string().uuid() },
+    }, async ({ approval_id }) => {
+        const result = await approveApproval(approval_id, server.server && approvalClientName(server.server));
+        return { ...j(result), ...('code' in result ? { isError: true } : {}) };
+    });
     if (options?.chatConfirmEnabled !== false && (!options?.scopes || options.chatConfirmEnabled === true) &&
         !options?.scopes?.some(scope => scope === 'tester' || scope === 'agent')) {
         server.registerTool('confirm_approval', {
@@ -48,7 +68,7 @@ export function registerApprovalTools(server, options) {
     }, async () => {
         const { data, error } = await db()
             .from('action_approvals')
-            .select('id, action, tier, channel, summary, status, requested_at, expires_at')
+            .select('id, action, tier, channel, summary, status, requested_at, expires_at, decided_via, decided_by')
             .eq('project_id', getProjectId())
             .eq('status', 'pending')
             .gt('expires_at', new Date().toISOString())
@@ -56,6 +76,6 @@ export function registerApprovalTools(server, options) {
             .limit(25);
         if (error)
             return toolError(dbToolError(error));
-        return j({ pending: data ?? [], count: data?.length ?? 0 });
+        return j({ pending: (data ?? []).map((row) => ({ ...row, ...(row.decided_via === 'sandbox' ? { decision_channel: 'sandbox' } : {}) })), count: data?.length ?? 0 });
     });
 }

package/build/tools/campaigns.js

@@ -18,6 +18,7 @@ import { checkPlanLimit } from '../plan-limits.js';
 import { buildVoicePrompt, buildEmailSystemPrompt, deriveTemplateVariables, validateTemplate } from '../lib/voice.js';
 import { fireWebhookEvent } from '../lib/webhook-events.js';
 import { approvalExcerpt, assertChannelCanExecute, currentChannelContext, requestApproval, checkApproval, withApproval } from '../lib/action-approvals.js';
+import { sandboxAudience, broadcastApprovalNext } from '../lib/sandbox-audience.js';
 import { resolveSegmentContactIds, resolveSendAudience } from '../lib/send-audience.js';
 import { generateEmailFromBrief, parseAudienceRules } from '../lib/email-generation.js';
 import { getAnthropicModelId } from '../anthropic-model.js';
@@ -1578,6 +1579,7 @@ export function registerCampaignTools(server) {
         else {
             content = { subject: subject, body_html: html, body_text: body_text ?? approvalExcerpt(html, 100000), blocks: null };
         }
+        const delivery = await sandboxAudience(projectId, resolved.contactIds);
         const campaignName = name ?? `Broadcast - ${content.subject.slice(0, 120)}`;
         const payload = {
             site_id: site.id,
@@ -1603,18 +1605,18 @@ export function registerCampaignTools(server) {
             subject: content.subject,
             segment_name: segment_id ? segmentName : null,
             audience_label: segment_id ? null : `"${segmentName}"`,
-            recipient_count: resolved.contactIds.length,
+            recipient_count: delivery.recipient_count,
             body_excerpt: approvalExcerpt(content.body_html),
             send_at: sendAt,
         });
         return j({
             ...approval,
             rendered: { subject: content.subject, body_html: stripActiveEmailContent(content.body_html).html, body_text: content.body_text },
-            recipient_count: resolved.contactIds.length,
+            ...delivery,
             audience: { label: segmentName, segment_id: segment_id ?? null, ...heldBackLines(resolved) },
             site: { id: site.id, name: site.name, from_email: site.from_email },
             send_at: sendAt ?? 'right after approval',
-            next: 'Show the user the subject, recipient count and approve_url. After a person approves, call send_broadcast with only approval_id. Do not say it was sent before that call succeeds.',
+            next: broadcastApprovalNext(approval, delivery.sandbox),
         });
     });
     server.registerTool('clone_campaign', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.142",
+  "version": "1.0.144",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",