@sendinel/mcp-server 1.0.229 → 1.0.230

package/build/db.d.ts

@@ -54,6 +54,12 @@ export declare function runWithClient<T>(client: any, fn: () => Promise<T>, requ
 export declare function runWithToolContext<T>(toolGroup: string, toolName: string, fn: () => Promise<T> | T, scopes?: readonly string[] | null): Promise<T>;
 /** Keep the consumed-approval marker inside this async call; model input cannot set it. */
 export declare function runWithApprovedTesterRequest<T>(action: string, fn: () => Promise<T> | T): Promise<T>;
+/**
+ * #4853: server-only marker that the tester gate table, param carve-outs, a positive non-sandbox
+ * read and (for state-dependent tools) a positive draft read all allowed this one call without a
+ * person's approval. It is not a consumed approval: inner gates (live trigger edits) stay armed.
+ */
+export declare function runWithPolicyTesterRequest<T>(action: string, fn: () => Promise<T> | T): Promise<T>;
 /**
  * Request-scoped identity set via runWithClient() (HTTP transport).
  * Undefined under stdio, where the process env is the single-project source of truth.
@@ -61,6 +67,7 @@ export declare function runWithApprovedTesterRequest<T>(action: string, fn: () =
 export declare function requestContext(): {
     scopes?: readonly string[];
     approvedTesterAction?: string;
+    policyTesterAction?: string;
     projectId?: string;
     approvalMode?: string;
     channel?: string;

package/build/db.js

@@ -61,6 +61,17 @@ export async function runWithApprovedTesterRequest(action, fn) {
         throw new Error('Tester application requires request context');
     return _requestStore.run({ ...current, approvedTesterAction: action }, fn);
 }
+/**
+ * #4853: server-only marker that the tester gate table, param carve-outs, a positive non-sandbox
+ * read and (for state-dependent tools) a positive draft read all allowed this one call without a
+ * person's approval. It is not a consumed approval: inner gates (live trigger edits) stay armed.
+ */
+export async function runWithPolicyTesterRequest(action, fn) {
+    const current = _requestStore.getStore();
+    if (!current)
+        throw new Error('Tester policy application requires request context');
+    return _requestStore.run({ ...current, policyTesterAction: action }, fn);
+}
 /**
  * Request-scoped identity set via runWithClient() (HTTP transport).
  * Undefined under stdio, where the process env is the single-project source of truth.
@@ -71,6 +82,7 @@ export function requestContext() {
         ? {
             scopes: ctx.scopes,
             approvedTesterAction: ctx.approvedTesterAction,
+            policyTesterAction: ctx.policyTesterAction,
             projectId: ctx.projectId,
             approvalMode: ctx.approvalMode,
             channel: ctx.channel,

package/build/lib/action-approvals.js

@@ -6,7 +6,8 @@ import { z } from 'zod';
 import { GATED_ACTIONS, PROTECTED_ACTIONS } from './approval-actions.js';
 export { isApprovalGatedAction } from './approval-actions.js';
 import { isHumanRequestableAdminTool } from './admin-tools.js';
-import { isTesterRequest, isApplyingTesterRequest } from './tester-policy.js';
+import { isTesterRequest, isApplyingTesterRequest, isPolicyApplyingTesterRequest } from './tester-policy.js';
+import { credentialGateClass } from './credential-gate-table.js';
 import { logTesterRequestAudit } from './tester-request-audit.js';
 import { approvalStore } from './tester-requests-store.js';
 import { createHash } from 'node:crypto';
@@ -26,8 +27,18 @@ export function getApprovalTier(action, params) {
     if (scopes && !scopes.includes('admin') && !scopes.includes('tester') && !scopes.includes('agent') &&
         isHumanRequestableAdminTool(action))
         return PROTECTED_ACTIONS.has(action) ? 'protected' : 'gated';
-    if (isTesterRequest(action))
-        return isApplyingTesterRequest(action) ? 'autonomous' : 'gated';
+    if (isTesterRequest(action)) {
+        if (isApplyingTesterRequest(action))
+            return 'autonomous';
+        // #4853: a policy-allowed draft edit falls through to the same rules as any write credential,
+        // so inner gates (live trigger edits, activation) stay armed. Everything else stays gated.
+        if (!isPolicyApplyingTesterRequest(action))
+            return 'gated';
+    }
+    else if (scopes && (scopes.includes('tester') || scopes.includes('agent')) && !credentialGateClass(action)) {
+        // #4853: an agent/tester call to a tool missing from the gate table fails closed.
+        return PROTECTED_ACTIONS.has(action) ? 'protected' : 'gated';
+    }
     // CRITICAL: Protected actions ALWAYS require approval, even in autonomous mode.
     // These are irreversible (GDPR delete, merge, etc.) — no opt-out.
     if (PROTECTED_ACTIONS.has(action)) {

package/build/lib/approval-human-eligibility.d.ts

@@ -17,6 +17,7 @@ export declare function humanApprovalEligible(action: string, projectId: string,
 export declare function chatConfirmConnectionEnabled(identity?: {
     scopes?: readonly string[];
     approvedTesterAction?: string;
+    policyTesterAction?: string;
     projectId?: string;
     approvalMode?: string;
     channel?: string;

package/build/lib/credential-gate-table.d.ts

@@ -0,0 +1,34 @@
+/**
+ * #4853 gate classification for agent and tester credentials on NON-sandbox projects.
+ * Kevin, 2026-11-12: "Gate only sends + deletes (Recommended)".
+ *
+ * One entry per registered MCP tool (plus every GATED_ACTIONS/PROTECTED_ACTIONS name), and
+ * __tests__/credential-gate-table.test.ts fails when a registered tool has no entry. A name that
+ * is not in this table is `gated` (fail closed): getApprovalTier returns gated for an
+ * agent/tester call to it, and resolveTesterGate never lets it through.
+ *
+ *   autonomous  applies without a person; tester setup writes still write a tester_applied audit row
+ *               whose approver is the policy, not a person
+ *   draft_only  autonomous only while the target campaign is a draft (never activated, no
+ *               enrollments, no queued sends, not scheduled); gated otherwise or when unreadable
+ *   gated       a person approves (sandbox projects keep their own auto-approve rules)
+ *   protected   a person approves with a typed confirmation
+ *
+ * The entry is the tier of the tool's sending/deleting form. Existing param rules in
+ * getApprovalTier (dry runs, non-active status changes, unpublished pages) are unchanged, and
+ * TESTER_PARAM_GATES below gates specific forms of otherwise autonomous tester setup tools.
+ *
+ * This table decides only whether a person must click. It never decides whether a credential
+ * may call a tool at all: agentConnectionAllowsTool / testerConnectionAllowsTool still refuse
+ * every delete, send, access and import tool for those connections. Person connections, API
+ * keys and service credentials do not use this table.
+ */
+export type CredentialGate = 'autonomous' | 'draft_only' | 'gated' | 'protected';
+export declare const CREDENTIAL_GATE_TABLE: Readonly<Record<string, CredentialGate>>;
+/** Undefined means unclassified, which every caller must treat as gated. */
+export declare function credentialGateClass(tool: string): CredentialGate | undefined;
+/**
+ * Param forms of autonomous/draft_only tester setup tools that still need a person. Each returns a
+ * reason when gated. A value that is not exactly the safe value is gated (fail closed).
+ */
+export declare const TESTER_PARAM_GATES: Readonly<Record<string, (params: Record<string, unknown>) => string | null>>;

package/build/lib/credential-gate-table.js

@@ -0,0 +1,386 @@
+export const CREDENTIAL_GATE_TABLE = Object.freeze({
+    // ── protected: Irreversible data loss or deletes: a person approves with a typed confirmation.
+    action_ccpa_request: 'protected',
+    delete_segment: 'protected',
+    delete_subscriber_data: 'protected',
+    identify_inactive: 'protected',
+    merge_subscribers: 'protected',
+    promote_ab_winner: 'protected',
+    // ── gated: Sends or enqueues to real people, deletes or data loss, access/credential/billing, bulk imports, public publishing.
+    abuse_monitor_override: 'gated', // overrides a Sendinel safety control
+    activate_campaigns: 'gated',
+    add_list_members: 'gated',
+    add_list_members_by_filter: 'gated',
+    approve_approval: 'gated', // is a person's approval decision; agent/tester credentials can never decide
+    archive_form: 'gated',
+    broadcast_to_segment: 'gated',
+    bulk_update_subscribers: 'gated',
+    commit_staged_import: 'gated', // imports a staged file; imports stay gated
+    configure_platform_trigger: 'gated', // an inbound event can start sends to contacts
+    confirm_approval: 'gated', // is a person's approval decision; agent/tester credentials can never decide
+    connect_platform: 'gated', // stores platform credentials (access/credential)
+    create_agent_mailbox: 'gated',
+    create_api_key: 'gated',
+    create_blog_post: 'gated',
+    create_custom_webhook: 'gated', // mints an inbound signing secret (access/credential)
+    delete_campaign: 'gated',
+    delete_campaign_step: 'gated',
+    delete_content_block: 'gated',
+    delete_custom_field: 'gated',
+    delete_landing_page: 'gated',
+    delete_list: 'gated',
+    delete_provider_credential: 'gated',
+    delete_signature: 'gated',
+    delete_social_post: 'gated',
+    delete_subscriber_view: 'gated',
+    delete_template: 'gated',
+    delete_webhook_subscription: 'gated',
+    discard_staged_import: 'gated', // discards uploaded data (data loss)
+    disconnect_platform: 'gated',
+    draft_agent_reply: 'gated',
+    emit_contact_event: 'gated',
+    enroll_automation: 'gated',
+    enroll_contact: 'gated',
+    enroll_in_escalation_ladder: 'gated',
+    enroll_segment: 'gated',
+    identify_subscriber: 'gated',
+    import_brand_kit_text: 'gated',
+    import_subscribers: 'gated',
+    install_connector_schema: 'gated',
+    install_connector_view: 'gated',
+    invite_team_member: 'gated',
+    launch_campaign: 'gated',
+    publish_dmarc_record: 'gated',
+    recheck_domain_dns: 'gated',
+    remove_blackout_date: 'gated', // can allow sends on a blocked date
+    remove_campaign_branch: 'gated', // removes saved config (delete)
+    remove_campaign_goal: 'gated', // removes saved config (delete)
+    remove_list_members: 'gated',
+    remove_suppression: 'gated',
+    remove_synced_folder: 'gated', // removes a sync (delete)
+    remove_team_member: 'gated',
+    replay_enrollment_dlq_rows: 'gated',
+    reply_to_comment: 'gated',
+    resend_invitation: 'gated', // extends workspace access (access)
+    resume_warmup: 'gated', // resumes sending
+    resync_connector: 'gated',
+    retry_send_queue_rows: 'gated', // re-enqueues sends to real people
+    revoke_api_key: 'gated',
+    revoke_invitation: 'gated',
+    rollback_provider_switch: 'gated', // changes the live sending provider
+    rotate_custom_webhook_secret: 'gated',
+    run_list_hygiene: 'gated', // bulk suppression of contacts
+    schedule_newsletter_issue: 'gated',
+    schedule_social_post: 'gated',
+    send_awaiting_reply: 'gated',
+    send_broadcast: 'gated',
+    send_newsletter_issue: 'gated',
+    send_sms: 'gated',
+    send_sms_campaign: 'gated',
+    send_test_email: 'gated',
+    send_transactional: 'gated',
+    set_connector_mapping: 'gated',
+    set_contact_sms_consent: 'gated',
+    set_link_domain: 'gated',
+    set_member_project_access: 'gated',
+    set_subscriber_tags: 'gated', // a tag can trigger campaigns that send
+    set_team_member_role: 'gated',
+    start_platform_migration: 'gated', // bulk contact import
+    start_provider_switch: 'gated',
+    subscribe_to_newsletter: 'gated', // sends a confirmation email to a real person
+    subscribe_webhook: 'gated',
+    tenant_export_full: 'gated',
+    trigger_content_pipeline: 'gated', // can auto-publish when the owner enabled it
+    update_asset_link: 'gated',
+    update_campaign_status: 'gated',
+    update_form: 'gated',
+    update_landing_page: 'gated',
+    update_short_link: 'gated',
+    update_webhook_subscription: 'gated',
+    // ── draft_only: State-dependent: autonomous only while the target campaign is a draft (resolveTesterGate reads it).
+    add_campaign_branch: 'draft_only', // branching changes the path of live mail once active
+    add_campaign_step: 'draft_only', // adds an email to the campaign; live mail changes once it is active
+    create_ab_test: 'draft_only', // adds variants that send once the campaign is active
+    set_campaign_goal: 'draft_only', // a goal exits contacts from live mail once active
+    set_campaign_trigger: 'draft_only', // changes who starts the campaign; live once active
+    update_campaign: 'draft_only', // name/segment/trigger/schedule; a live campaign changes who gets mail
+    update_campaign_step: 'draft_only', // edits email copy; live mail changes once the campaign is active
+    // ── autonomous: Reads, drafts, templates, segments, forms, consented single contacts and config: no person needed, still audited.
+    abuse_monitor_status: 'autonomous',
+    adapt_social_post: 'autonomous',
+    add_blackout_date: 'autonomous',
+    add_subscriber: 'autonomous',
+    add_suppression: 'autonomous',
+    add_synced_folder: 'autonomous',
+    add_white_label_domain: 'autonomous',
+    approve_data_proposal: 'autonomous',
+    approve_draft: 'autonomous',
+    campaign_advisor: 'autonomous',
+    cancel_approval: 'autonomous',
+    cancel_send_queue_rows: 'autonomous',
+    check_ab_significance: 'autonomous',
+    check_approval: 'autonomous',
+    check_content_consistency: 'autonomous',
+    check_link_domain: 'autonomous',
+    clone_campaign: 'autonomous',
+    clone_sequence_template: 'autonomous',
+    comment_on_post: 'autonomous',
+    convert_imported_campaigns: 'autonomous',
+    create_asset_link: 'autonomous',
+    create_campaign: 'autonomous',
+    create_campaign_set: 'autonomous',
+    create_campaign_with_content: 'autonomous', // drafts only; activate=true stays gated (TESTER_PARAM_GATES)
+    create_content_block: 'autonomous',
+    create_custom_field: 'autonomous',
+    create_draft: 'autonomous',
+    create_escalation_ladder: 'autonomous',
+    create_form: 'autonomous',
+    create_landing_page: 'autonomous',
+    create_list: 'autonomous',
+    create_newsletter: 'autonomous',
+    create_newsletter_issue: 'autonomous',
+    create_segment: 'autonomous',
+    create_segment_nl: 'autonomous',
+    create_sender: 'autonomous',
+    create_short_link: 'autonomous',
+    create_signature: 'autonomous',
+    create_site: 'autonomous',
+    create_social_campaign: 'autonomous',
+    create_social_post: 'autonomous',
+    create_subscriber_view: 'autonomous',
+    create_survey: 'autonomous',
+    create_template: 'autonomous',
+    create_template_from_brief: 'autonomous',
+    deliverability_check: 'autonomous',
+    describe_tool: 'autonomous',
+    diagnose_delivery_issue: 'autonomous',
+    dismiss_ai_work_item: 'autonomous',
+    dnsbl_check: 'autonomous',
+    dnsbl_delisting_draft: 'autonomous',
+    draft_social_reply: 'autonomous',
+    enrich_subscriber: 'autonomous',
+    estimate_segment_size: 'autonomous',
+    explain_contact_score: 'autonomous',
+    export_data: 'autonomous',
+    find_duplicates: 'autonomous',
+    generate_blog_post_image: 'autonomous',
+    generate_email: 'autonomous',
+    generate_qr_code: 'autonomous',
+    generate_signature_from_brand_kit: 'autonomous',
+    get_agent_proposal: 'autonomous',
+    get_agent_thread: 'autonomous',
+    get_ai_work_item: 'autonomous',
+    get_approval_level: 'autonomous',
+    get_asset_link_views: 'autonomous',
+    get_attention_decision: 'autonomous',
+    get_audit_stats: 'autonomous',
+    get_blog_post: 'autonomous',
+    get_brand_voice: 'autonomous',
+    get_campaign: 'autonomous',
+    get_campaign_calendar: 'autonomous',
+    get_connector_status: 'autonomous',
+    get_contact_neighborhood: 'autonomous',
+    get_contact_schema: 'autonomous',
+    get_cron_runs: 'autonomous',
+    get_dmarc_status: 'autonomous',
+    get_domain_health: 'autonomous',
+    get_draft: 'autonomous',
+    get_effective_signature: 'autonomous',
+    get_engagement_insights: 'autonomous',
+    get_enrollment_dlq: 'autonomous',
+    get_enrollment_status: 'autonomous',
+    get_form_stats: 'autonomous',
+    get_hygiene_config: 'autonomous',
+    get_landing_page: 'autonomous',
+    get_model_registry: 'autonomous',
+    get_newsletter: 'autonomous',
+    get_newsletter_stats: 'autonomous',
+    get_operator_skill: 'autonomous',
+    get_outbound_digest: 'autonomous',
+    get_plan_limits: 'autonomous',
+    get_plan_usage: 'autonomous',
+    get_portfolio_analytics: 'autonomous',
+    get_portfolio_stats: 'autonomous',
+    get_provider_switch_status: 'autonomous',
+    get_queue_status: 'autonomous',
+    get_reply_status: 'autonomous',
+    get_revenue_analytics: 'autonomous',
+    get_schedule: 'autonomous',
+    get_scheduled_touches: 'autonomous',
+    get_scoring_rules: 'autonomous',
+    get_send_dlq: 'autonomous',
+    get_send_queue_rows: 'autonomous',
+    get_short_link_stats: 'autonomous',
+    get_site_insights: 'autonomous',
+    get_sites: 'autonomous',
+    get_sms_provider_status: 'autonomous',
+    get_social_engagement: 'autonomous',
+    get_social_post: 'autonomous',
+    get_stats: 'autonomous',
+    get_subscriber: 'autonomous',
+    get_subscriber_timeline: 'autonomous',
+    get_survey: 'autonomous',
+    get_survey_results: 'autonomous',
+    get_template: 'autonomous',
+    get_warmup_status: 'autonomous',
+    get_white_label_settings: 'autonomous',
+    how_to: 'autonomous',
+    ingest_brand_assets_by_url: 'autonomous',
+    invoke_tool: 'autonomous',
+    list_ab_tests: 'autonomous',
+    list_agent_inbox: 'autonomous',
+    list_agent_proposals: 'autonomous',
+    list_ai_work_items: 'autonomous',
+    list_api_keys: 'autonomous',
+    list_asset_links: 'autonomous',
+    list_audit_actions: 'autonomous',
+    list_audit_log: 'autonomous',
+    list_automations: 'autonomous',
+    list_awaiting_replies: 'autonomous',
+    list_blackout_dates: 'autonomous',
+    list_blog_destinations: 'autonomous',
+    list_blog_posts: 'autonomous',
+    list_brand_assets: 'autonomous',
+    list_campaign_branches: 'autonomous',
+    list_campaign_goals: 'autonomous',
+    list_campaign_steps: 'autonomous',
+    list_campaigns: 'autonomous',
+    list_ccpa_requests: 'autonomous',
+    list_companies: 'autonomous',
+    list_connected_platforms: 'autonomous',
+    list_connector_tables: 'autonomous',
+    list_content_blocks: 'autonomous',
+    list_content_sources: 'autonomous',
+    list_custom_fields: 'autonomous',
+    list_custom_webhooks: 'autonomous',
+    list_data_proposals: 'autonomous',
+    list_deletion_log: 'autonomous',
+    list_dmarc_reports: 'autonomous',
+    list_domains: 'autonomous',
+    list_drafts: 'autonomous',
+    list_email_log: 'autonomous',
+    list_escalation_ladder_status: 'autonomous',
+    list_event_log: 'autonomous',
+    list_forms: 'autonomous',
+    list_hygiene_audit: 'autonomous',
+    list_import_history: 'autonomous',
+    list_invitations: 'autonomous',
+    list_landing_pages: 'autonomous',
+    list_lists: 'autonomous',
+    list_my_support_tickets: 'autonomous',
+    list_newsletter_issues: 'autonomous',
+    list_newsletter_subscribers: 'autonomous',
+    list_newsletters: 'autonomous',
+    list_notifications: 'autonomous',
+    list_operator_skills: 'autonomous',
+    list_pending_approvals: 'autonomous',
+    list_platform_events: 'autonomous',
+    list_projects: 'autonomous',
+    list_provider_credentials: 'autonomous',
+    list_recommended_segments: 'autonomous',
+    list_sandbox_webhook_events: 'autonomous',
+    list_segments: 'autonomous',
+    list_sequence_templates: 'autonomous',
+    list_signatures: 'autonomous',
+    list_sms_inbound: 'autonomous',
+    list_sms_log: 'autonomous',
+    list_social_campaigns: 'autonomous',
+    list_social_comments: 'autonomous',
+    list_social_connections: 'autonomous',
+    list_social_engagements: 'autonomous',
+    list_social_posts: 'autonomous',
+    list_staged_imports: 'autonomous',
+    list_subscriber_views: 'autonomous',
+    list_subscribers: 'autonomous',
+    list_subscribers_by_segment: 'autonomous',
+    list_suppressions: 'autonomous',
+    list_surveys: 'autonomous',
+    list_synced_folders: 'autonomous',
+    list_team_members: 'autonomous',
+    list_templates: 'autonomous',
+    list_webhook_subscriptions: 'autonomous',
+    list_win_back_draft: 'autonomous',
+    mark_agent_message: 'autonomous',
+    mark_ai_work_item_seen: 'autonomous',
+    mark_notifications_read: 'autonomous',
+    migrate_campaigns_from: 'autonomous',
+    onboard_new_site: 'autonomous',
+    optimize_subject_lines: 'autonomous',
+    pause_warmup: 'autonomous',
+    performance_report: 'autonomous',
+    post_ticket_reply: 'autonomous',
+    preview_automation: 'autonomous',
+    preview_campaign_audience: 'autonomous',
+    preview_email: 'autonomous',
+    preview_segment: 'autonomous',
+    preview_signature: 'autonomous',
+    preview_sms_cost: 'autonomous',
+    promote_draft_to_campaign: 'autonomous',
+    propose_campaign_from_data: 'autonomous',
+    propose_social_reply: 'autonomous',
+    read_agent_message: 'autonomous',
+    recommend_blog_post_images: 'autonomous',
+    recovery_plan: 'autonomous',
+    refresh_domain_dns: 'autonomous',
+    register_domain: 'autonomous',
+    rehost_brand_asset: 'autonomous',
+    reject_draft: 'autonomous',
+    request_social_reply: 'autonomous',
+    restore_template_version: 'autonomous',
+    review_campaign_portfolio: 'autonomous',
+    run_portfolio_analysis: 'autonomous',
+    search_tools: 'autonomous',
+    set_active_project: 'autonomous',
+    set_brand_logo: 'autonomous',
+    set_white_label_settings: 'autonomous',
+    setup_campaign_from_brief: 'autonomous',
+    snooze_ai_work_item: 'autonomous',
+    submit_ai_context_event: 'autonomous',
+    submit_support_ticket: 'autonomous',
+    subscriber_export: 'autonomous',
+    suggest_content_topics: 'autonomous',
+    suggest_send_time: 'autonomous',
+    translate_template: 'autonomous',
+    trigger_automation: 'autonomous',
+    unenroll_contact: 'autonomous',
+    unsubscribe_from_newsletter: 'autonomous',
+    unsubscribe_subscriber: 'autonomous',
+    update_brand_voice: 'autonomous',
+    update_custom_field: 'autonomous',
+    update_hygiene_config: 'autonomous',
+    update_list: 'autonomous',
+    update_newsletter: 'autonomous',
+    update_scoring_rules: 'autonomous',
+    update_segment: 'autonomous',
+    update_signature: 'autonomous',
+    update_site: 'autonomous',
+    update_social_post: 'autonomous',
+    update_subscriber: 'autonomous',
+    update_subscriber_view: 'autonomous',
+    update_survey: 'autonomous',
+    update_template: 'autonomous',
+    update_warmup_schedule: 'autonomous',
+    upload_brand_asset: 'autonomous',
+    validate_template: 'autonomous',
+});
+/** Undefined means unclassified, which every caller must treat as gated. */
+export function credentialGateClass(tool) {
+    return Object.prototype.hasOwnProperty.call(CREDENTIAL_GATE_TABLE, tool) ? CREDENTIAL_GATE_TABLE[tool] : undefined;
+}
+/**
+ * Param forms of autonomous/draft_only tester setup tools that still need a person. Each returns a
+ * reason when gated. A value that is not exactly the safe value is gated (fail closed).
+ */
+export const TESTER_PARAM_GATES = Object.freeze({
+    // Safety carve-out: turning either unsubscribe flag off removes the unsubscribe link from live mail.
+    update_site: (params) => (params.unsub_link_enabled !== undefined && params.unsub_link_enabled !== true)
+        || (params.unsub_one_click_enabled !== undefined && params.unsub_one_click_enabled !== true)
+        ? 'unsubscribe_link_disabled' : null,
+    // Turning off the activation approval flag weakens a later send gate.
+    create_campaign: (params) => params.requires_approval === false ? 'activation_approval_off'
+        : params.send_at !== undefined && params.send_at !== null ? 'schedules_send' : null,
+    // activate=true creates and turns on sending in one call.
+    create_campaign_with_content: (params) => params.activate !== false ? 'activates_campaign' : null,
+    // Scheduling a send is a send decision even on a draft.
+    update_campaign: (params) => params.send_at !== undefined && params.send_at !== null ? 'schedules_send' : null,
+});

package/build/lib/tester-policy-gate.d.ts

@@ -0,0 +1,22 @@
+/** Why a tester setup call still needs a person. `null` reason means the policy allowed it. */
+export type TesterGateDecision = {
+    tier: 'autonomous';
+    reason: null;
+} | {
+    tier: 'gated';
+    reason: string;
+};
+/**
+ * A campaign is a draft for #4853 only when every read succeeds and shows: status draft, no
+ * schedule or recurrence, zero enrollment rows and zero send_queue rows. There is no
+ * activated-at column, so "never activated" is inferred from enrollments and queued sends.
+ * Any error, missing row or unknown count returns false (gated).
+ */
+export declare function campaignIsDraft(campaignId: unknown): Promise<boolean>;
+/**
+ * #4853: decide whether one tester setup call needs a person. Autonomous only when ALL hold:
+ * the table classifies the tool autonomous/draft_only, no TESTER_PARAM_GATES rule fires, the
+ * project reads as NOT a sandbox (sandbox projects keep their existing auto-approve path
+ * unchanged) and, for draft_only tools, the target campaign reads as a draft.
+ */
+export declare function resolveTesterGate(action: string, params: Record<string, unknown>): Promise<TesterGateDecision>;

package/build/lib/tester-policy-gate.js

@@ -0,0 +1,82 @@
+import { getProjectId } from '../project.js';
+import { credentialGateClass, TESTER_PARAM_GATES } from './credential-gate-table.js';
+import { sandboxAutoApproveUnavailableReason } from './sandbox-approvals.js';
+import { approvalStore } from './tester-requests-store.js';
+const gated = (reason) => ({ tier: 'gated', reason });
+/**
+ * A campaign is a draft for #4853 only when every read succeeds and shows: status draft, no
+ * schedule or recurrence, zero enrollment rows and zero send_queue rows. There is no
+ * activated-at column, so "never activated" is inferred from enrollments and queued sends.
+ * Any error, missing row or unknown count returns false (gated).
+ */
+export async function campaignIsDraft(campaignId) {
+    if (typeof campaignId !== 'string' || !campaignId)
+        return false;
+    try {
+        const store = approvalStore();
+        const projectId = getProjectId();
+        const { data, error } = await store.from('campaigns')
+            .select('id, project_id, status, send_at, recurrence_rule, recurrence_parent_id')
+            .eq('id', campaignId).eq('project_id', projectId).maybeSingle();
+        if (error || !data || data.id !== campaignId || data.project_id !== projectId)
+            return false;
+        if (data.status !== 'draft' || data.send_at != null || data.recurrence_rule != null || data.recurrence_parent_id != null)
+            return false;
+        const enrollments = await store.from('campaign_enrollments')
+            .select('id', { count: 'exact', head: true }).eq('campaign_id', campaignId);
+        if (enrollments.error || typeof enrollments.count !== 'number' || enrollments.count !== 0)
+            return false;
+        const queued = await store.from('send_queue')
+            .select('id', { count: 'exact', head: true }).eq('project_id', projectId).eq('campaign_id', campaignId);
+        if (queued.error || typeof queued.count !== 'number' || queued.count !== 0)
+            return false;
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** update_campaign_step names a step, never a campaign: resolve it in this project first. */
+async function stepCampaignId(stepId) {
+    if (typeof stepId !== 'string' || !stepId)
+        return undefined;
+    try {
+        const { data, error } = await approvalStore().from('campaign_steps')
+            .select('id, campaign_id').eq('id', stepId).maybeSingle();
+        if (error || !data || data.id !== stepId || typeof data.campaign_id !== 'string')
+            return undefined;
+        return data.campaign_id;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * #4853: decide whether one tester setup call needs a person. Autonomous only when ALL hold:
+ * the table classifies the tool autonomous/draft_only, no TESTER_PARAM_GATES rule fires, the
+ * project reads as NOT a sandbox (sandbox projects keep their existing auto-approve path
+ * unchanged) and, for draft_only tools, the target campaign reads as a draft.
+ */
+export async function resolveTesterGate(action, params) {
+    const gate = credentialGateClass(action);
+    if (gate !== 'autonomous' && gate !== 'draft_only')
+        return gated(gate ? `table_${gate}` : 'unclassified');
+    const paramReason = TESTER_PARAM_GATES[action]?.(params);
+    if (paramReason)
+        return gated(paramReason);
+    let sandbox;
+    try {
+        sandbox = await sandboxAutoApproveUnavailableReason(getProjectId(), action);
+    }
+    catch {
+        return gated('project_unreadable');
+    }
+    if (sandbox !== 'not_sandbox')
+        return gated(sandbox === null ? 'sandbox_project' : 'project_unreadable');
+    if (gate === 'draft_only') {
+        const campaignId = action === 'update_campaign_step' ? await stepCampaignId(params.step_id) : params.campaign_id;
+        if (!await campaignIsDraft(campaignId))
+            return gated('campaign_not_draft_or_unreadable');
+    }
+    return { tier: 'autonomous', reason: null };
+}

package/build/lib/tester-policy.d.ts

@@ -4,3 +4,8 @@ export declare const TESTER_SITE_FIELDS: ReadonlySet<string>;
 export declare function isTesterRequest(action: string): boolean;
 /** Server-only context set after the shared core has consumed a human-approved payload. */
 export declare function isApplyingTesterRequest(action: string): boolean;
+/**
+ * Server-only context set after the #4853 gate table allowed this tester call without a person
+ * (a draft, never a send or delete). Model input cannot set it; see resolveTesterGate.
+ */
+export declare function isPolicyApplyingTesterRequest(action: string): boolean;

package/build/lib/tester-policy.js

@@ -16,3 +16,10 @@ export function isTesterRequest(action) {
 export function isApplyingTesterRequest(action) {
     return isTesterRequest(action) && requestContext()?.approvedTesterAction === action;
 }
+/**
+ * Server-only context set after the #4853 gate table allowed this tester call without a person
+ * (a draft, never a send or delete). Model input cannot set it; see resolveTesterGate.
+ */
+export function isPolicyApplyingTesterRequest(action) {
+    return isTesterRequest(action) && requestContext()?.policyTesterAction === action;
+}

package/build/lib/tester-request-audit.d.ts

@@ -1,2 +1,2 @@
 /** Central audit infrastructure, including when the edited site belongs to a BYOD project. */
-export declare function logTesterRequestAudit(event: 'tester_request' | 'tester_applied', action: string, approvalId: string, approver: string | null): Promise<void>;
+export declare function logTesterRequestAudit(event: 'tester_request' | 'tester_applied', action: string, approvalId: string | null, approver: string | null, extra?: Record<string, unknown>): Promise<void>;

package/build/lib/tester-request-audit.js

@@ -2,13 +2,13 @@ import { requestContext } from '../db.js';
 import { getProjectId } from '../project.js';
 import { approvalStore } from './tester-requests-store.js';
 /** Central audit infrastructure, including when the edited site belongs to a BYOD project. */
-export async function logTesterRequestAudit(event, action, approvalId, approver) {
+export async function logTesterRequestAudit(event, action, approvalId, approver, extra = {}) {
     const ctx = requestContext();
     const { error } = await approvalStore().from('audit_log').insert({
         project_id: getProjectId(), actor_type: ctx?.actorType ?? 'mcp', actor_id: ctx?.actorId ?? null,
         action: `mcp_connection.${event}`, resource_type: 'mcp_connection', resource_id: ctx?.oauthTokenId,
         channel: ctx?.channel ?? 'mcp',
-        details: { connection_id: ctx?.oauthTokenId, approval_id: approvalId, tool: action, approver },
+        details: { connection_id: ctx?.oauthTokenId, approval_id: approvalId, tool: action, approver, ...extra },
     });
     if (error)
         throw new Error(`Failed to audit tester ${event}: ${error.message}`);

package/build/lib/tester-requests.js

@@ -1,13 +1,41 @@
 import { isDeepStrictEqual } from 'node:util';
 import { z } from 'zod';
-import { requestContext, runWithApprovedTesterRequest } from '../db.js';
+import { requestContext, runWithApprovedTesterRequest, runWithPolicyTesterRequest } from '../db.js';
 import { getProjectId } from '../project.js';
-import { withApproval } from './action-approvals.js';
+import { assertResourcesBelongToActiveProject, currentChannelContext, ResourceProjectRefusal, withApproval } from './action-approvals.js';
+import { plainRefusalResult } from './db-error.js';
 import { withoutApprovalSnapshot } from './approval-snapshot.js';
 import { approvalStore } from './tester-requests-store.js';
 import { logTesterRequestAudit } from './tester-request-audit.js';
 import { TESTER_SITE_FIELDS } from './tester-policy.js';
+import { resolveTesterGate } from './tester-policy-gate.js';
+import { captureTesterRequestSnapshot } from './tester-request-snapshot.js';
 const text = (message) => ({ content: [{ type: 'text', text: message }] });
+function appliedOk(result) {
+    if (result?.isError)
+        return false;
+    try {
+        const value = JSON.parse(result.content.filter((block) => block.type === 'text')
+            .map((block) => block.text).join('\n'));
+        // A saved campaign also has a requires_approval column: only an approval response carries approval_id.
+        const approvalResponse = value.requires_approval === true && typeof value.approval_id === 'string';
+        return !value.error && !approvalResponse && !!(value.id || value.campaign_id || value.ok === true);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * #4853 policy path: no approval row, but every successful write still writes a tester_applied
+ * audit row whose approver is the policy, never a person. An audit failure surfaces as an error.
+ */
+async function applyByPolicy(action, params, run) {
+    const result = await runWithPolicyTesterRequest(action, run);
+    if (appliedOk(result)) {
+        await logTesterRequestAudit('tester_applied', action, null, 'policy', { policy: 'credential_gate_table' });
+    }
+    return result;
+}
 /** Only installed for an authenticated tester connection, never selected by tool arguments. */
 export function testerRequestTool(action, config, handler) {
     const original = config.inputSchema instanceof z.ZodObject ? config.inputSchema : z.object(config.inputSchema);
@@ -39,13 +67,35 @@ export function testerRequestTool(action, config, handler) {
                     return text(`Invalid request: ${parsed.error.message}`);
                 params = parsed.data;
                 delete params.approval_id;
-                // This human approval replaces the compound tool's model confirmation preview.
-                if (action === 'create_campaign_with_content')
-                    params.confirmed = true;
             }
             if (action === 'update_site' && Object.keys(params).some(key => key !== 'site_id' && params[key] !== undefined && !TESTER_SITE_FIELDS.has(key))) {
                 return text('Tester connections may request only site footer and unsubscribe settings.');
             }
+            if (!approval_id) {
+                // #4853: drafts and config apply without a person on non-sandbox projects; anything else
+                // (sends, live campaigns, unsubscribe-off, unreadable state, sandbox) keeps the approval flow.
+                // An unverified channel never skips a person; requestApproval then refuses it as before.
+                const gate = currentChannelContext().verified ? await resolveTesterGate(action, params) : { tier: 'gated' };
+                // The approval path's target check (site, segment, campaign, step in THIS project). If any
+                // target cannot be read here, fall back to the approval path, which refuses it as before.
+                const targetsReadable = gate.tier === 'autonomous'
+                    && await captureTesterRequestSnapshot(action, params, getProjectId()).then(() => true, () => false);
+                if (targetsReadable) {
+                    // #4447: the same one-sentence ownership refusal requestApproval gives, before any write.
+                    try {
+                        await assertResourcesBelongToActiveProject(action, params);
+                    }
+                    catch (error) {
+                        if (error instanceof ResourceProjectRefusal)
+                            return plainRefusalResult(error.message);
+                        throw error;
+                    }
+                    return applyByPolicy(action, params, () => handler(params, extra));
+                }
+                // This human approval replaces the compound tool's model confirmation preview.
+                if (action === 'create_campaign_with_content')
+                    params.confirmed = true;
+            }
             return withApproval(action, async (frozen) => {
                 const result = await runWithApprovedTesterRequest(action, () => handler(frozen, extra));
                 // All seven setup tools report a successful apply as a resource id or an explicit ok.

package/build/server.js

@@ -207,7 +207,7 @@ export function isProjectPinnedWriteTool(name, scopes) {
     return (isTesterConnection(scopes) && TESTER_REQUEST_TOOLS.has(name)) || name === 'send_broadcast' || name === 'activate_campaigns' || isApprovalGatedAction(name);
 }
 export function testerConnectionRefusal(name) {
-    return `"${name}" is not available to a tester connection. Testers can read and request human approval for campaign setup: ${[...TESTER_REQUEST_TOOLS].join(', ')}. update_site is limited to footer/unsubscribe fields. Every setup call returns approval_id, approve_url and preview_text; after a person approves, retry with only approval_id. Deletes, sends, access/role/key/team tools, provider credentials, imports and create_agent_mailbox are refused. Ask the workspace owner to promote the connection in Dashboard > Agent Connect for direct writes.`;
+    return `"${name}" is not available to a tester connection. Testers can read and set up campaigns with: ${[...TESTER_REQUEST_TOOLS].join(', ')}. update_site is limited to footer/unsubscribe fields. Draft campaigns, steps, triggers on drafts and footer edits apply right away. Changes that can reach real people (a live or scheduled campaign, activate=true, turning the unsubscribe link off) return approval_id, approve_url and preview_text instead; after a person approves, retry with only approval_id. Deletes, sends, access/role/key/team tools, provider credentials, imports and create_agent_mailbox are refused. Ask the workspace owner to promote the connection in Dashboard > Agent Connect for direct writes.`;
 }
 // Names of the meta-tools gateway mode registers in place of the real catalog
 // (see tools/gateway.ts). Grouped as 'gateway' rather than any real tool

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sendinel/mcp-server",
-  "version": "1.0.229",
+  "version": "1.0.230",
   "description": "AI-controlled email operations control plane for campaigns, contacts, segments, analytics, and multi-provider sending via MCP.",
   "mcpName": "ai.sendinel/mcp-server",
   "type": "module",