@sendinel/mcp-server 1.0.63 → 1.0.65

package/build/lib/action-approvals.d.ts

@@ -1,3 +1,5 @@
+/** True when the action name is on the gated or protected list (the default-deny test uses this). */
+export declare function isApprovalGatedAction(action: string): boolean;
 export type ApprovalTier = 'autonomous' | 'gated' | 'protected';
 export declare function getApprovalTier(action: string, params?: Record<string, unknown>): ApprovalTier;
 /**
@@ -64,3 +66,23 @@ export declare function checkApproval(approvalId: string, options?: {
     status: string;
     decided_by?: string;
 }>;
+type ToolResult = {
+    content: Array<{
+        type: 'text';
+        text: string;
+    }>;
+};
+/**
+ * Wrap a tool handler in the standard approval flow (#4005). In standard mode the first call
+ * (no approval_id) records the exact arguments and returns the approval request without running
+ * the handler; the follow-up call with an approved approval_id runs the handler on those same
+ * arguments. getApprovalTier() decides when no approval is needed (autonomous mode, special
+ * cases), so autonomous mode and send_broadcast's never-self-approves rule live in one place.
+ * Add `approval_id: z.string().uuid().optional()` to the tool's inputSchema.
+ */
+export declare function withApproval<A extends object, R extends ToolResult>(action: string, handler: (args: A, extra?: unknown) => Promise<R> | R, options?: {
+    display?: (args: A) => Promise<ApprovalDisplay> | ApprovalDisplay;
+}): (args: A & {
+    approval_id?: string;
+}, extra?: unknown) => Promise<R | ToolResult>;
+export {};

package/build/lib/action-approvals.js

@@ -32,6 +32,46 @@ const GATED_ACTIONS = new Set([
     'remove_team_member', // revokes workspace access
     'set_team_member_role', // changes workspace access privileges
     'delete_provider_credential', // permanently removes or revokes stored provider access
+    // #4005: every outward or destructive tool is approval-gated unless it sits on APPROVAL_EXEMPT
+    // (src/lib/approval-exempt.ts). These are wrapped with withApproval() in their tool files.
+    'send_sms', // texts a real phone number
+    'send_sms_campaign', // can activate an SMS broadcast
+    'send_newsletter_issue', // sends an issue to every subscriber
+    'schedule_newsletter_issue', // queues an issue to every subscriber
+    'reply_to_comment', // queues a public LinkedIn reply
+    'send_awaiting_reply', // sends a real email
+    'send_test_email', // sends a real email to any address
+    'remove_suppression', // re-enables mail to a suppressed address
+    'schedule_social_post', // publishes to a connected social account
+    'invite_team_member', // emails an outside person and grants access
+    'set_member_project_access', // changes workspace access
+    'revoke_invitation', // cancels a pending teammate invitation
+    'create_api_key', // mints new access to the project
+    'revoke_api_key', // breaks every integration using the key
+    'tenant_export_full', // copies all customer data out of Sendinel
+    'enroll_contact', // starts real emails to a contact
+    'enroll_automation', // starts automated messages to a contact
+    'enroll_in_escalation_ladder', // starts email/SMS escalation to a contact
+    'set_contact_sms_consent', // changes the consent record that allows texting
+    'bulk_update_subscribers', // bulk contact data write
+    'update_webhook_subscription', // can redirect event data to a new URL
+    'delete_webhook_subscription', // removes an outbound data channel
+    'delete_campaign', // deletes a campaign and its steps
+    'delete_campaign_step', // deletes an email from a campaign
+    'delete_content_block', // deletes customer content
+    'delete_custom_field', // deletes a field and its values
+    'delete_landing_page', // takes a public page down and deletes it
+    'delete_list', // deletes a contact list
+    'delete_signature', // deletes a saved signature
+    'delete_social_post', // deletes a social post record
+    'delete_subscriber_view', // deletes a saved view
+    'delete_template', // deletes an email template
+    'import_brand_kit_text', // overwrites the brand kit
+    'disconnect_platform', // deletes stored platform credentials
+    'start_provider_switch', // moves a sending domain to another provider
+    'update_landing_page', // publishing makes the page public (see special case below)
+    'create_blog_post', // auto_publish posts to the customer's own site (see special case below)
+    'replay_enrollment_dlq_rows', // confirmed replay sends real emails (see special case below)
 ]);
 const PROTECTED_ACTIONS = new Set([
     'delete_subscriber_data', // GDPR delete — irreversible
@@ -41,6 +81,10 @@ const PROTECTED_ACTIONS = new Set([
     'promote_ab_winner', // deletes losing variants
     'action_ccpa_request', // CCPA delete completion is irreversible
 ]);
+/** True when the action name is on the gated or protected list (the default-deny test uses this). */
+export function isApprovalGatedAction(action) {
+    return GATED_ACTIONS.has(action) || PROTECTED_ACTIONS.has(action);
+}
 export function getApprovalTier(action, params) {
     // CRITICAL: Protected actions ALWAYS require approval, even in autonomous mode.
     // These are irreversible (GDPR delete, merge, etc.) — no opt-out.
@@ -48,6 +92,9 @@ export function getApprovalTier(action, params) {
         // Exception: identify_inactive in dry_run mode is safe (read-only report)
         if (action === 'identify_inactive' && params?.dry_run !== false)
             return 'autonomous';
+        // Without confirmed=true the tool only previews which variants would be deleted.
+        if (action === 'promote_ab_winner' && params?.confirmed !== true)
+            return 'autonomous';
         if (action === 'action_ccpa_request' && !(params?.status === 'completed' && params?.request_type === 'delete'))
             return 'autonomous';
         return 'protected';
@@ -73,6 +120,13 @@ export function getApprovalTier(action, params) {
     // in campaigns.ts — so the special case must live here, not just at the call site.
     if (action === 'update_campaign_status' && params?.status !== 'active')
         return 'autonomous';
+    // Only the publishing / sending form of these is outward; drafts, previews and dry runs are not.
+    if (action === 'update_landing_page' && params?.status !== 'published')
+        return 'autonomous';
+    if (action === 'create_blog_post' && params?.auto_publish !== true)
+        return 'autonomous';
+    if (action === 'replay_enrollment_dlq_rows' && params?.confirmed !== true)
+        return 'autonomous';
     if (GATED_ACTIONS.has(action))
         return 'gated';
     return 'autonomous';
@@ -216,9 +270,17 @@ export function buildApprovalSummary(action, params, display = {}) {
         remove_team_member: (p) => `Remove team member ${p.user_id} from the organization`,
         set_team_member_role: (p) => `Change team member ${p.user_id}'s role to ${p.role}`,
         delete_provider_credential: (p) => `Delete saved ${p.provider ?? 'provider'} credential ${p.credential_id} (${p.source})`,
+        send_sms: (p) => `Send an SMS to ${p.to_number ?? `contact ${p.contact_id ?? 'unknown'}`} (${p.classification ?? 'marketing'}): "${approvalExcerpt(p.body)}"`,
+        send_newsletter_issue: (p) => `Send newsletter issue ${display.issue_subject ? `"${display.issue_subject}"` : p.issue_id} now to every subscriber of newsletter ${display.newsletter_name ?? p.newsletter_id}`,
+        reply_to_comment: (p) => `Queue a LinkedIn reply to ${p.comment_url_or_urn}: "${approvalExcerpt(p.text)}"`,
+        send_awaiting_reply: (p) => `Send an email to ${p.to}${p.subject ? ` — "${approvalExcerpt(p.subject, 120)}"` : ''}${p.html || p.text ? ` — "${approvalExcerpt(p.html ?? p.text)}"` : ''} and track a reply for ${p.expect_reply_within}`,
+        remove_suppression: (p) => `Remove ${p.email} from the suppression list — mail to this address will resume`,
     };
     const fn = summaries[action];
-    return fn ? fn(params) : `Execute ${action} with provided parameters`;
+    if (fn)
+        return fn(params);
+    const payload = JSON.stringify(normalizeApprovalParams(params));
+    return `Execute ${action} with: ${payload.length > 400 ? `${payload.slice(0, 399)}…` : payload}`;
 }
 function approvalPageUrl(approvalId) {
     const base = (process.env.NEXT_PUBLIC_APP_URL ?? process.env.SENDINEL_APP_URL ?? process.env.APP_URL ?? 'https://sendinel.ai').replace(/\/$/, '');
@@ -337,3 +399,34 @@ export async function checkApproval(approvalId, options = {}) {
         decided_by: claimed.decided_by,
     };
 }
+function toolText(value) {
+    return { content: [{ type: 'text', text: value }] };
+}
+/**
+ * Wrap a tool handler in the standard approval flow (#4005). In standard mode the first call
+ * (no approval_id) records the exact arguments and returns the approval request without running
+ * the handler; the follow-up call with an approved approval_id runs the handler on those same
+ * arguments. getApprovalTier() decides when no approval is needed (autonomous mode, special
+ * cases), so autonomous mode and send_broadcast's never-self-approves rule live in one place.
+ * Add `approval_id: z.string().uuid().optional()` to the tool's inputSchema.
+ */
+export function withApproval(action, handler, options = {}) {
+    return async (args, extra) => {
+        const { approval_id, ...params } = args;
+        const channelContext = currentChannelContext();
+        const decision = assertChannelCanExecute(action, params, channelContext);
+        if (!decision.allowed)
+            return toolText(decision.reason ?? 'This channel cannot request this action.');
+        if (decision.tier !== 'autonomous') {
+            if (!approval_id) {
+                const display = options.display ? await options.display(params) : undefined;
+                return toolText(JSON.stringify(await requestApproval(action, params, undefined, channelContext, display), null, 2));
+            }
+            const check = await checkApproval(approval_id, { consume: true, action, params });
+            if (!check.approved) {
+                return toolText(`Approval ${approval_id} is ${check.status}. ${check.status === 'pending' ? 'Waiting for human approval via dashboard.' : 'Request a new approval.'}`);
+            }
+        }
+        return handler(params, extra);
+    };
+}

package/build/lib/approval-exempt.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Write- and admin-scope MCP tools that are deliberately NOT approval-gated (#4005).
+ *
+ * __tests__/approval-default-deny.test.ts fails for any registered tool whose scope is write or
+ * admin unless it is approval-gated (listed in GATED_ACTIONS or PROTECTED_ACTIONS in
+ * action-approvals.ts AND wrapped with withApproval()/requestApproval()) or listed here with a
+ * one-line reason. Nothing that sends, posts or publishes outside Sendinel, or deletes or
+ * irreversibly changes customer data, belongs here: gate it instead. A new outward tool therefore
+ * cannot ship ungated by accident.
+ *
+ * Entries marked FOLLOW-UP are exempt today but flagged for a closer look.
+ */
+export declare const APPROVAL_EXEMPT: Record<string, string>;

package/build/lib/approval-exempt.js

@@ -0,0 +1,134 @@
+/**
+ * Write- and admin-scope MCP tools that are deliberately NOT approval-gated (#4005).
+ *
+ * __tests__/approval-default-deny.test.ts fails for any registered tool whose scope is write or
+ * admin unless it is approval-gated (listed in GATED_ACTIONS or PROTECTED_ACTIONS in
+ * action-approvals.ts AND wrapped with withApproval()/requestApproval()) or listed here with a
+ * one-line reason. Nothing that sends, posts or publishes outside Sendinel, or deletes or
+ * irreversibly changes customer data, belongs here: gate it instead. A new outward tool therefore
+ * cannot ship ungated by accident.
+ *
+ * Entries marked FOLLOW-UP are exempt today but flagged for a closer look.
+ */
+export const APPROVAL_EXEMPT = {
+    abuse_monitor_override: "admin-only override of Sendinel abuse monitoring on the caller own project; no outward send",
+    add_blackout_date: "adds a no-send date; reduces sending",
+    add_campaign_branch: "adds branching config to a campaign; recreatable and sends nothing itself",
+    add_campaign_step: "adds an email to a campaign; sends only when the campaign is activated (gated)",
+    add_subscriber: "adds one contact; contact count limits apply and nothing is sent",
+    add_suppression: "only stops mail to an address; reduces sending",
+    add_synced_folder: "starts syncing a Drive folder into the project own media library; inbound only",
+    add_white_label_domain: "adds a pending branding domain record; reversible and sends nothing",
+    approve_data_proposal: "turns a proposal into an AI draft for review; sends nothing",
+    approve_draft: "marks a draft ready; sending still requires a gated send or activation",
+    cancel_send_queue_rows: "cancels queued mail before it sends; reduces sending",
+    clone_campaign: "creates a draft copy of a campaign; nothing sends until activated (gated)",
+    clone_sequence_template: "creates a draft campaign from a template; nothing sends until activated (gated)",
+    comment_on_post: "creates a review card; the tool description says it never posts",
+    commit_staged_import: "copies a staged file into the project own media library; internal",
+    configure_platform_trigger: "configures what an inbound platform event does; sends nothing itself",
+    connect_platform: "stores an inbound platform connection; sends nothing outward",
+    convert_imported_campaigns: "without create it only previews; with create it makes new drafts that cannot send until activated (gated)",
+    create_ab_test: "creates a draft A/B test; nothing sends until the campaign is activated (activation is gated)",
+    create_asset_link: "creates an email-gated download link; sends nothing",
+    create_campaign: "creates a DRAFT campaign; it must be activated through update_campaign_status (gated)",
+    create_campaign_set: "creates draft campaigns; activate_campaigns (gated) turns them on",
+    create_content_block: "creates reusable content; sends nothing",
+    create_custom_field: "adds a field definition; nothing sent or deleted",
+    create_custom_webhook: "creates an INBOUND webhook endpoint; no outward data flow",
+    create_draft: "creates a draft for review; sends nothing",
+    create_escalation_ladder: "creates ladder config; contacts are only messaged by enroll_in_escalation_ladder (gated)",
+    create_form: "creates a signup form; sends nothing",
+    create_landing_page: "creates a DRAFT page; publishing via update_landing_page status=published is gated",
+    create_list: "creates an empty list; sends nothing",
+    create_newsletter: "creates a newsletter definition; sends nothing",
+    create_newsletter_issue: "creates a draft issue; send_newsletter_issue and schedule_newsletter_issue are gated",
+    create_segment: "creates a saved audience definition; sends nothing",
+    create_segment_nl: "creates a saved audience definition from plain language; sends nothing",
+    create_sender: "creates a pending sender identity; sends nothing until verified and used",
+    create_short_link: "creates a tracked short link; sends nothing",
+    create_signature: "creates a saved signature; sends nothing",
+    create_site: "admin creates a site record; sends nothing",
+    create_social_campaign: "creates a UTM-tracked link record; posting is schedule_social_post (gated)",
+    create_social_post: "creates a social post record; publishing is schedule_social_post (gated)",
+    create_subscriber_view: "saves a filter view; internal",
+    create_survey: "creates a survey; sends nothing",
+    create_template: "creates a template; sends nothing",
+    create_template_from_brief: "creates a draft template; sends nothing",
+    diagnose_delivery_issue: "runs a diagnosis and writes an internal report",
+    discard_staged_import: "discards a staged import file the caller uploaded; no customer contacts or sends affected",
+    dismiss_ai_work_item: "dismisses an internal AI work item",
+    draft_social_reply: "drafts reply text for review; never posts",
+    enrich_subscriber: "adds enrichment data to one contact; sends nothing",
+    generate_blog_post_image: "generates an image for a draft post; sends nothing",
+    generate_email: "AI-writes email copy and returns it; sends nothing",
+    generate_qr_code: "generates a QR image; sends nothing",
+    get_audit_stats: "admin read of audit stats; changes nothing",
+    get_enrollment_status: "read-style lookup registered with write scope; changes nothing",
+    get_provider_switch_status: "read-style lookup registered with write scope; changes nothing",
+    ingest_brand_assets_by_url: "pulls assets into the project media library; SSRF-guarded, internal",
+    list_audit_log: "admin read of the audit log; changes nothing",
+    list_campaign_steps: "read-style lookup registered with write scope; changes nothing",
+    list_ccpa_requests: "admin read of CCPA requests; changes nothing",
+    list_deletion_log: "admin read of the deletion log; changes nothing",
+    list_invitations: "admin read of invitations; changes nothing",
+    mark_ai_work_item_seen: "marks an internal AI work item as seen",
+    mark_notifications_read: "marks the caller own notifications read",
+    migrate_campaigns_from: "imports other-platform campaigns as drafts; nothing sends until activated (gated)",
+    onboard_new_site: "creates a site and a pending sending-domain record; sends no mail and does not register the domain",
+    optimize_subject_lines: "generates subject-line suggestions; sends nothing",
+    pause_warmup: "pauses warmup; reduces sending",
+    post_ticket_reply: "replies on the caller own Sendinel support ticket; not a message to a customer contact",
+    promote_draft_to_campaign: "creates a campaign in draft status; activation is gated",
+    propose_campaign_from_data: "creates a proposal for review; sends nothing",
+    propose_social_reply: "creates a review card; a human Accept posts it",
+    register_domain: "creates a pending sending-domain record; does not register the domain with a provider",
+    rehost_brand_asset: "copies an asset into Sendinel own storage; internal",
+    reject_draft: "rejects a draft; reduces sending",
+    remove_blackout_date: "removes a no-send date; recreatable. FOLLOW-UP: it can allow sends on a blocked date",
+    remove_campaign_branch: "removes branching config; recreatable with add_campaign_branch, no customer records deleted",
+    remove_campaign_goal: "removes a goal definition; recreatable with set_campaign_goal, no customer records deleted",
+    remove_synced_folder: "stops a folder sync; does not delete imported assets or revoke the Drive share",
+    request_social_reply: "creates a review card from an external trigger; never posts",
+    resend_invitation: "extends an invitation expiry and returns the link; sends no email from the server",
+    restore_template_version: "restores an earlier template version; sends nothing",
+    resume_warmup: "resumes the owner own warmup schedule; sends only mail already scheduled",
+    retry_send_queue_rows: "makes already-queued retry rows eligible; no new audience is created",
+    review_campaign_portfolio: "writes an internal review report only",
+    rollback_provider_switch: "restores the prior provider state after a failed switch; start_provider_switch is gated",
+    run_list_hygiene: "suppresses invalid or bouncing addresses, which only reduces who receives mail",
+    run_portfolio_analysis: "writes an internal analysis report only",
+    set_active_project: "switches which project this connection targets; no data written",
+    set_campaign_goal: "sets a goal definition on a campaign; sends nothing",
+    set_subscriber_tags: "edits tags on one contact; tag triggers go through enrollment rules the owner configured. FOLLOW-UP: confirm tag-triggered automations are covered",
+    set_white_label_settings: "edits branding settings; reversible and sends nothing",
+    setup_campaign_from_brief: "creates a draft campaign from a brief; nothing sends until activated (gated)",
+    snooze_ai_work_item: "snoozes an internal AI work item",
+    start_platform_migration: "imports data into Sendinel from a connected platform; inbound only",
+    submit_ai_context_event: "records an internal context event for the AI worker",
+    submit_support_ticket: "files a ticket with Sendinel support from the caller own account; not a message to a customer contact",
+    subscribe_to_newsletter: "adds one subscriber who asked to join; the confirmation flow applies",
+    translate_template: "creates a translated template draft; sends nothing",
+    trigger_content_pipeline: "marks content sources ready for the cron; the pipeline lands drafts unless the owner enabled auto-publish. FOLLOW-UP: review the cron publish path",
+    unsubscribe_from_newsletter: "only stops mail to a subscriber; reduces sending",
+    trigger_automation: 'generates a draft into the approval queue (or returns it with dry_run); nothing is sent until a person approves the draft',
+    unsubscribe_subscriber: "only stops mail to a contact; reduces sending",
+    update_brand_voice: "edits brand voice text on the caller own project; internal",
+    update_campaign: "edits campaign settings; status changes go through update_campaign_status (gated). FOLLOW-UP: same live-edit caveat as update_campaign_step",
+    update_campaign_step: "edits email copy; sends only through an already-gated activation. FOLLOW-UP: editing a live campaign changes what goes out (#4005 summary)",
+    update_custom_field: "renames or edits a field definition; values are untouched",
+    update_hygiene_config: "changes hygiene settings; suppression runs are gated (identify_inactive) or only reduce sending",
+    update_list: "renames or edits a list; membership changes are gated",
+    update_newsletter: "edits newsletter settings; sends nothing",
+    update_scoring_rules: "edits scoring settings; sends nothing",
+    update_segment: "edits a saved audience definition; sends only through gated activations",
+    update_signature: "edits a saved signature; sends nothing",
+    update_site: "admin edits site settings; sends nothing",
+    update_social_post: "edits a social post record; publishing is schedule_social_post (gated)",
+    update_subscriber: "edits one contact record; recoverable and sends nothing",
+    update_subscriber_view: "edits a saved filter view; internal",
+    update_survey: "edits a survey; sends nothing",
+    update_template: "edits a template; previous versions can be restored with restore_template_version",
+    update_warmup_schedule: "edits the warmup schedule; reduces or paces sending",
+    upload_brand_asset: "adds an asset to the project media library; internal",
+};

package/build/server.d.ts

@@ -8,6 +8,15 @@ export declare const ALL_TOOL_GROUPS: string[];
 export type ToolGroup = keyof typeof GROUP_REGISTRY;
 export type ToolGroupMap = Record<string, string>;
 export declare function getRequiredScope(name: string): string;
+/**
+ * Marker scope for a tester connection (#4011), a new OAuth grant until an owner promotes it. It adds no
+ * permission level: such a connection sees every read tool plus only the approval-gated tools.
+ */
+export declare const TESTER_CONNECTION_SCOPE = "tester";
+export declare function isTesterConnection(scopes: readonly string[] | null | undefined): boolean;
+/** Tools a tester connection may see and call: reads, plus anything that goes through a person's approval. */
+export declare function testerConnectionAllowsTool(name: string): boolean;
+export declare function testerConnectionRefusal(name: string): string;
 export declare const GATEWAY_TOOL_NAMES: string[];
 /**
  * Collects tool-name → group metadata from the same group registry used by

package/build/server.js

@@ -1,4 +1,5 @@
 import { runWithToolContext } from './db.js';
+import { isApprovalGatedAction } from './lib/action-approvals.js';
 import { registerAnalyticsTools } from './tools/analytics.js';
 import { registerCampaignTools } from './tools/campaigns.js';
 import { registerCampaignSetTools } from './tools/campaign-sets.js';
@@ -175,6 +176,24 @@ function scopeAllows(keyScopes, required) {
     const requiredLevel = SCOPE_HIERARCHY[required] ?? 99;
     return keyScopes.some((s) => (SCOPE_HIERARCHY[s] ?? 0) >= requiredLevel);
 }
+/**
+ * Marker scope for a tester connection (#4011), a new OAuth grant until an owner promotes it. It adds no
+ * permission level: such a connection sees every read tool plus only the approval-gated tools.
+ */
+export const TESTER_CONNECTION_SCOPE = 'tester';
+export function isTesterConnection(scopes) {
+    return !!scopes?.includes(TESTER_CONNECTION_SCOPE);
+}
+/** Tools a tester connection may see and call: reads, plus anything that goes through a person's approval. */
+export function testerConnectionAllowsTool(name) {
+    return getRequiredScope(name) === 'read'
+        || name === 'send_broadcast'
+        || name === 'activate_campaigns'
+        || isApprovalGatedAction(name);
+}
+export function testerConnectionRefusal(name) {
+    return `"${name}" is not available to a tester connection. A tester connection can read, and can ask a person to approve outward actions: call an approval-gated tool (for example send_broadcast) and a person approves it from the approve_url it returns. To change this tool directly, ask the workspace owner to promote the connection in Dashboard > Agent Connect.`;
+}
 // Names of the meta-tools gateway mode registers in place of the real catalog
 // (see tools/gateway.ts). Grouped as 'gateway' rather than any real tool
 // group -- a gateway-mode client's toolGroups list holds the groups it can
@@ -285,14 +304,19 @@ function createScopeProxy(server, scopes, toolGroup) {
                     // ── Scope enforcement (only when scopes are provided) ─────────────
                     if (scopes !== null) {
                         const required = getRequiredScope(name);
-                        if (!scopeAllows(scopes, required)) {
+                        const tester = isTesterConnection(scopes);
+                        const allowed = () => tester
+                            ? testerConnectionAllowsTool(name)
+                            : scopeAllows(scopes, required);
+                        if (!allowed()) {
                             // Don't register tools the key can't access — they won't appear in tool list
                             return;
                         }
                         // Wrap handler with runtime scope check (defense in depth)
                         const guardedHandler = (...args) => {
-                            if (!scopeAllows(scopes, required)) {
-                                return { content: [{ type: 'text', text: `Forbidden: this action requires "${required}" scope.` }] };
+                            if (!allowed()) {
+                                const text = tester ? testerConnectionRefusal(name) : `Forbidden: this action requires "${required}" scope.`;
+                                return { content: [{ type: 'text', text }] };
                             }
                             return runWithToolContext(toolGroup, name, () => handler(...args));
                         };

package/build/tools/ab-testing.js

@@ -1,3 +1,4 @@
+import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { db } from '../db.js';
 import { getProjectId } from '../project.js';
@@ -161,11 +162,12 @@ export function registerAbTestingTools(server) {
         },
         description: 'End an A/B test and keep only the winning variant. Requires confirmation (two-call pattern). Deletes the losing variant step(s) from campaign_steps.',
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             test_id: z.string().uuid(),
             winner: z.string().optional().describe('Override winner variant label (default: use statistically determined winner)'),
             confirmed: z.boolean().optional().describe('Set true to execute after previewing'),
         },
-    }, async ({ test_id, winner, confirmed }) => {
+    }, withApproval('promote_ab_winner', async ({ test_id, winner, confirmed }) => {
         const projectId = getProjectId();
         const { data: test, error: testErr } = await db()
             .from('ab_tests')
@@ -228,5 +230,5 @@ export function registerAbTestingTools(server) {
             deleted_variants: losingVariants,
             message: `A/B test "${test.name}" completed. Variant "${winnerLabel}" promoted, ${loserSteps.length} losing step(s) removed.`,
         });
-    });
+    }));
 }

package/build/tools/analytics.js

@@ -1,3 +1,4 @@
+import { withApproval } from '../lib/action-approvals.js';
 import { fetchAllRows, readAllRows } from '@sendinel/domain';
 import { z } from 'zod';
 import { db, adminDb, requestContext } from '../db.js';
@@ -1452,13 +1453,14 @@ export function registerAnalyticsTools(server) {
         },
         description: 'Schedule a social campaign post via a connected BYO publisher (UploadPost, Buffer). Returns publisherPostId on success.',
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             campaign_id: z.string().uuid().describe('UUID of the social campaign in Sendinel'),
             content: z.string().min(1).describe('Post body text'),
             publisher: z.enum(socialPublishers).describe('Which BYO publisher to route through'),
             scheduled_at: z.string().optional().describe('ISO 8601 datetime. Omit for immediate publish.'),
             media_urls: z.array(z.string().url()).optional().describe('Optional image/video URLs'),
         },
-    }, async (p) => {
+    }, withApproval('schedule_social_post', async (p) => {
         const projectId = getProjectId();
         const scheduledAt = p.scheduled_at ? new Date(p.scheduled_at) : undefined;
         if (scheduledAt && Number.isNaN(scheduledAt.getTime()))
@@ -1535,5 +1537,5 @@ export function registerAnalyticsTools(server) {
                 .eq('id', p.campaign_id);
             return txt(`Error: ${message}`);
         }
-    });
+    }));
 }

package/build/tools/automations.js

@@ -1,3 +1,4 @@
+import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import Anthropic from '@anthropic-ai/sdk';
 import { db } from '../db.js';
@@ -133,6 +134,7 @@ export function registerAutomationTools(server) {
         },
         description: 'Enroll a subscriber into active triggered automation campaigns. Match by campaign_id, trigger_event_name, or trigger_tag. Safe to call repeatedly.',
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             subscriber_id: z.string().uuid().describe('Subscriber/contact UUID to enroll'),
             campaign_id: z.string().uuid().optional().describe('Specific triggered campaign UUID'),
             site_id: z.string().uuid().optional().describe('Optional site scope when matching by trigger'),
@@ -143,7 +145,7 @@ export function registerAutomationTools(server) {
             next_send_at: z.string().datetime().optional().describe('First send time. Defaults to now.'),
             context: z.record(z.string(), z.unknown()).optional().describe('Optional enrollment context metadata'),
         },
-    }, enrollSubscriberIntoTriggeredCampaigns);
+    }, withApproval('enroll_automation', enrollSubscriberIntoTriggeredCampaigns));
     server.registerTool('create_escalation_ladder', {
         title: 'Create Escalation Ladder',
         annotations: {
@@ -214,12 +216,13 @@ export function registerAutomationTools(server) {
         },
         description: 'Enroll a subscriber into an active triggered campaign that has escalation ladder steps. Reuses enroll_automation suppression and unsubscribe checks.',
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             subscriber_id: z.string().uuid().describe('Subscriber/contact UUID to enroll'),
             campaign_id: z.string().uuid().describe('Triggered campaign UUID with ladder steps'),
             next_send_at: z.string().datetime().optional().describe('First eligible send time. Defaults to now.'),
             context: z.record(z.string(), z.unknown()).optional().describe('Optional enrollment context metadata'),
         },
-    }, async ({ subscriber_id, campaign_id, next_send_at, context }) => {
+    }, withApproval('enroll_in_escalation_ladder', async ({ subscriber_id, campaign_id, next_send_at, context }) => {
         const projectId = getProjectId();
         const { data: gate, error: gateError } = await db()
             .from('campaign_step_gates')
@@ -237,7 +240,7 @@ export function registerAutomationTools(server) {
             next_send_at,
             context: { ...(context ?? {}), escalation_ladder: true, project_id: projectId },
         });
-    });
+    }));
     server.registerTool('list_escalation_ladder_status', {
         title: 'List Escalation Ladder Status',
         annotations: {

package/build/tools/brand-kit.js

@@ -1,3 +1,4 @@
+import { withApproval } from '../lib/action-approvals.js';
 import { z } from 'zod';
 import { adminDb } from '../db.js';
 import { getProjectId } from '../project.js';
@@ -37,12 +38,13 @@ export function registerBrandKitTools(server) {
         },
         description: 'Import raw Brand Core / Brand Brain / Content Library / Brand Kit markdown text into the current project.',
         inputSchema: {
+            approval_id: z.string().uuid().optional().describe('Get this by calling once without it, then have a human approve the returned approve_url. Re-call with the same arguments plus this approval_id to run the action.'),
             text: z.string().min(1).describe('Raw markdown text from the Brand Core / Brand Kit companion output.'),
         },
-    }, async ({ text }) => {
+    }, withApproval('import_brand_kit_text', async ({ text }) => {
         const result = await callBrandKitApi('/api/v1/brand-kit/import-text', { text });
         return result.ok ? j(result.data) : j({ error: result.error });
-    });
+    }));
     server.registerTool('rehost_brand_asset', {
         title: 'Rehost Drive-Linked Brand Asset',
         annotations: {