2.1.0: execute_action and execute_method, with a forced permission prompt for irreversible tools

[matty-drexler]

What this changes

Adds two tools — execute_action (run an ir.actions.server) and execute_method (press a workflow button) — behind a shared ExecutionGuard, and makes unlink_record and execute_action prompt a human on every call regardless of Claude Code's permission mode.

Why

Brass-Monkey could read server actions but never run them, and had no way to press a workflow button. An agent wanting to confirm a sales order had to fake it by writing the state field — which sets a string and skips every side effect Odoo attaches to the real transition, leaving the database inconsistent.

The two tools are split deliberately rather than merged. Model methods are declared by the model and can be validated against live views before the call; server actions are mutable data rows that can change between introspection and execution. Different validation models, different tools.

execute_action

• Expands the whole child_ids tree and classifies on the union, so a multi wrapper containing one Python step is treated as Python.
• Blocks code / webhook / mail_post / sms behind acknowledge_unsafe — arbitrary execution, and outbound egress to third parties.
• Snapshots only the declarative states; where it cannot, the audit entry records why rather than logging an empty object.
• Returns any follow-up action as inert data. Never chains.

execute_method

• Hard, non-overridable deny-list on ORM primitives, so it cannot become a bypass around the guards on write_record / create_record / unlink_record.
• action_ / button_ / toggle_ naming convention; anything else needs acknowledge_unsafe.
• Verifies the method is bound to a <button type="object"> in the combined view arch, which covers Studio-added buttons.
• Snapshots workflow state markers around the call.

The permission-mode hole this also closes

acknowledge_unsafe assumes a human reads the refusal. Claude Code's auto and bypassPermissions modes remove the prompt entirely, so the agent could read its own refusal and immediately retry with the flag set — nobody ever sees the Python. unlink_record and execute_action now advertise _meta["anthropic/requiresUserInteraction"], which forces the prompt in every permission mode and suppresses "don't ask again".

Deliberately not set on write_record, create_record or execute_method: it prompts on every call, and applying it to routine data work would make auto mode unusable. Limits — Claude Code only, v2.1.199+, static, and headless --permission-prompt-tool converts allow to deny — are written up in docs/execution-safety.md.

How it was verified

• npm test passes locally — 98 tests, 16 files
• npm run build succeeds; bundle regenerated
• tools/list exercised over stdio against the built bundle: 25 tools, requiresUserInteraction present on exactly unlink_record and execute_action
• Tested against a live Odoo instance — NOT DONE. The run → _run fallback and the view-arch regex are precisely the parts mocks cannot validate. Needs an MCP Inspector pass before tagging.
• Docs / skills/ guidance updated to match (odoo-dev, odoo-data-ops, new docs/execution-safety.md)

Checklist

• dist/ is included — same-repo maintainer release path, which contributor-guard.yml explicitly permits
• DCO sign-off not required for same-repo PRs per the same workflow
• No credentials, live URLs, database names, or real customer data in the diff
• Both schema systems updated for the new tools — static JSON in src/tools/schemas.ts and co-located Zod
• Both new tools require an explicit justification and write to all three audit channels
• Tests added — tests/execution-tools.test.ts (14 cases) plus _meta assertions in the integration test

Also in this change

package-lock.json had drifted from package.json on two counts: the version (still 2.0.1) and the engines block added by the dependency roundup. Regenerated. Worth noting scripts/sync-version.mjs does not cover the lockfile — a gap that will recur next release.

Separately, GitHub is now reporting 2 vulnerabilities on main (1 high, 1 low). Unrelated to this PR, but worth a look.