@sendinel/mcp-server 1.0.223 → 1.0.225

package/build/lib/action-approvals.js

@@ -11,7 +11,7 @@ import { logTesterRequestAudit } from './tester-request-audit.js';
 import { approvalStore } from './tester-requests-store.js';
 import { createHash } from 'node:crypto';
 import { approvalSetupSummary, buildApprovalPreview, isHumanApprovalChannel, triggerChangeSummary, decodeHtmlEntities, stripHtmlComments } from '@sendinel/domain';
-import { requestContext } from '../db.js';
+import { adminDb, requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { captureApprovalSnapshot, withoutApprovalSnapshot, withoutApprovalDisplay } from './approval-snapshot.js';
 import { fireWebhookEvent } from './webhook-events.js';
@@ -705,7 +705,31 @@ export function withApproval(action, handler, options = {}) {
         let decidedBy;
         let decisionChannel;
         let consumedAt;
-        if (decision.tier !== 'autonomous') {
+        if (decision.tier === 'autonomous') {
+            try {
+                await assertResourcesBelongToActiveProject(action, params);
+            }
+            catch (error) {
+                if (!(error instanceof ResourceProjectRefusal))
+                    throw error;
+                const actor = requestContext();
+                try {
+                    const { error: auditError } = await adminDb().schema('email').from('audit_log').insert({
+                        project_id: getProjectId(), actor_type: actor?.actorType ?? 'mcp', actor_id: actor?.actorId ?? null,
+                        action: 'approval.resource_project_refused', resource_type: 'approval', channel: channelContext.channel,
+                        details: { action, tool: action, owner_project_id: error.ownerProjectId },
+                    });
+                    if (auditError)
+                        throw auditError;
+                }
+                catch {
+                    // An unavailable audit store must never turn a refusal into execution.
+                    console.warn('[mcp] Could not audit resource project refusal; request remains refused.');
+                }
+                return plainRefusalResult(error.message);
+            }
+        }
+        else {
             if (!approval_id) {
                 const display = options.display ? await options.display(params) : undefined;
                 try {

package/build/lib/db-error.d.ts

@@ -35,6 +35,12 @@ export declare function toolError(body: unknown): {
  */
 export declare class PlainToolRefusal extends Error {
 }
+/**
+ * Refusal class for plain refusals (#4811). The text stays the bare sentence, so the class rides in
+ * `_meta.error_code`: it survives the in-process MCP client hop behind invoke_tool, which clones the
+ * result and loses WeakSet identity. Foreign, missing and malformed ids share it (no existence oracle).
+ */
+export declare const PLAIN_REFUSAL_ERROR_CODE: ToolErrorCode;
 /** The refusal as tool text with isError, exempt from JSON re-coding by codedToolResult. */
 export declare function plainRefusalResult(message: string): {
     isError: true;
@@ -42,6 +48,9 @@ export declare function plainRefusalResult(message: string): {
         type: 'text';
         text: string;
     }[];
+    _meta: {
+        error_code: "conflict" | "forbidden" | "internal_error" | "not_found" | "plan_limit" | "validation_failed";
+    };
 };
 /** A table known to block a delete. `count` is best-effort; it may throw or return null. */
 export interface DeleteBlocker {

package/build/lib/db-error.js

@@ -55,9 +55,23 @@ export function toolError(body) {
 export class PlainToolRefusal extends Error {
 }
 const plainRefusalResults = new WeakSet();
+/**
+ * Refusal class for plain refusals (#4811). The text stays the bare sentence, so the class rides in
+ * `_meta.error_code`: it survives the in-process MCP client hop behind invoke_tool, which clones the
+ * result and loses WeakSet identity. Foreign, missing and malformed ids share it (no existence oracle).
+ */
+export const PLAIN_REFUSAL_ERROR_CODE = 'not_found';
+function hasPlainRefusalMeta(result) {
+    const meta = result?._meta;
+    return meta?.error_code === PLAIN_REFUSAL_ERROR_CODE;
+}
 /** The refusal as tool text with isError, exempt from JSON re-coding by codedToolResult. */
 export function plainRefusalResult(message) {
-    const result = { isError: true, content: [{ type: 'text', text: message }] };
+    const result = {
+        isError: true,
+        content: [{ type: 'text', text: message }],
+        _meta: { error_code: PLAIN_REFUSAL_ERROR_CODE },
+    };
     plainRefusalResults.add(result);
     return result;
 }
@@ -253,7 +267,7 @@ export function toolErrorClass(body) {
 }
 /** Add a stable class to refusals without dropping existing fields or success data. */
 export function codedToolResult(result) {
-    if (plainRefusalResults.has(result))
+    if (plainRefusalResults.has(result) || (result.isError === true && hasPlainRefusalMeta(result)))
         return result;
     let failed = result.isError === true;
     const content = result.content.map(block => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.223",
+  "version": "1.0.225",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",