fix(mcp): preserve thread command rejection reasons

[maria-rcks]

MCP thread tools discard the reason for refusing to settle an active thread or mutate a run that is no longer queued. Preserve nonempty string reasons from the two typed command-rejection errors under the existing orchestration_error code, capped at 1,000 Unicode characters. Lookup failures, other error types, and wrapped internal causes keep the generic message.

Closes #15586

Blacksmith verification: the added settle regression failed on the original mapping; both existing MCP test files then passed (8 tests), along with scoped lint/formatting, server typecheck, and server export checks. Coverage checks the settle reason, active-run survival, subsequent pin/unpin, queue edit/cancel refusals, and internal-cause redaction.

Unverified: a live provider calling these tools through the running client. Shared-runtime verification and final reviews are being coordinated separately. All required GitHub checks passed on dfc1edaa6ca8b0abb2492911d9c848b0c8d0e812, and Macroscope approved that head.

Implemented with gpt-6.1-sol (xhigh) through the Codex harness in T3 Code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Path: .coderabbit.config.ts
• Review profile: CHILL
• Plan: Advanced
• Run ID: 20d9948a-ec5c-4a40-ac08-099e729c36fd

📥 Commits

Reviewing files that changed from the base of the PR and between 17c0878 and fd7cc0d.

📒 Files selected for processing (4)

• apps/server/src/mcp/OrchestratorMcpToolkit.integration.test.ts
• apps/server/src/mcp/threadAccess.ts
• apps/server/src/mcp/toolkits/core.test.ts
• apps/server/src/mcp/toolkits/thread/handlers.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

---

📝 Walkthrough

Walkthrough

Thread command handlers now return eligible orchestrator rejection reasons in MCP failure messages. Tests cover cause filtering, message length, and failures when settling or editing and cancelling active work.

Changes

MCP orchestration failure mapping

Layer / File(s)	Summary
Convert and validate thread command failures apps/server/src/mcp/threadAccess.ts, apps/server/src/mcp/toolkits/thread/handlers.ts, apps/server/src/mcp/toolkits/core.test.ts, apps/server/src/mcp/OrchestratorMcpToolkit.integration.test.ts	Thread command handlers use dispatchFailure to expose non-empty string causes from dispatch and command-rejection errors, truncated to 1,000 Unicode code points. Other errors use the generic failure. Unit and integration tests cover failure messages and active-thread behavior.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Low

Suggested reviewers: juliusmarminge

Merge Risk: ⚪ Minimal · up to fd7cc

The thread tools preserve rejection reasons without a demonstrated private-detail disclosure. No actionable merge-blocking risk remains after normal checks.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to fd7cc

Rejection details improve usability, but the new filtering treats any nonempty string cause as safe to disclose. Existing access checks and redaction of object-based errors limit exposure; a concrete sensitive-string disclosure was not established by the inspected paths.

Retained concerns

• Medium · security · observed: The new public-error mapper uses runtime string type as a substitute for safe provenance. Internal dispatch failures and intentional public rejections share defect-bearing cause fields, so any nonempty internal string cause now crosses into an MCP response. This is an introduced disclosure-control weakness, not proof that a sensitive production string currently reaches a client.

Security review details

Security Blast Radius

• inferred — The demonstrated exposure is to MCP callers permitted to invoke affected thread commands. Existing checks require orchestration capability, live provider ownership for thread callers, and target-mode limits. Targets may be other threads in the environment, not only the caller’s own thread. The evidence does not establish a cross-environment or unauthenticated disclosure path.

Security Findings and Attack Paths

• inferred — The retained sensitive-data-exposure finding corresponds to a newly widened internal-cause-to-client path. A permitted caller can receive a raw string carried by an eligible dispatch error; sensitive disclosure depends on an internal producer supplying sensitive text in that form. That production source was not proven, and generic provider/adapter producers remain incompletely classified.

Trust Boundaries and Controls

• observed — Error tags, string type, nonemptiness, and a length cap gate disclosure. Tests demonstrate generic responses for Error/object causes and for a projection error carrying a private string. These are meaningful controls, but neither string type nor truncation establishes confidentiality or public provenance.

Hardening Proposals

• proposed — Represent intentional public rejection reasons separately from internal defect causes, and let the transport expose only that explicitly public representation. Preserve the generic fallback and length bound for all other failures.

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: preserving thread command rejection reasons in MCP tools.
Description check	✅ Passed	The description explains the problem and change, links the issue, and reports focused verification and limitations. It does not document explicit maintainer approval of scope or explain why the fix qu…
Linked Issues check	✅ Passed	#15586 requires MCP thread command rejections to expose their user-facing reason while keeping unexpected internal errors generic. threadAccess.ts returns nonempty string causes from `OrchestratorDi…
Out of Scope Changes check	✅ Passed	The reported changes are limited to MCP thread error mapping and tests for the #15586 behavior. The inspected handler changes apply the mapping to thread command dispatch paths; the test changes verif…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[macroscopeapp]

Approvability

Verdict: Approved at fd7cc0d

Macroscope's review found this PR approvable — This is a focused MCP error-handling fix that exposes bounded, actionable command-rejection reasons while preserving generic messages for internal failures. Existing successful behavior and data flows remain unchanged, with targeted unit and integration coverage added.

^{You can add or adjust custom eligibility rules. Learn more.}

Dismissing prior approval to re-evaluate fd7cc0d