Agent refuses to send email for admin account

[rbasche]

Prerequisites

• I searched open issues and discussions and did not find an existing report of this bug.
• This is not a security vulnerability. (Vulnerabilities go to GitHub Security Advisories — see SECURITY.md.)
• I am running the latest code from the dev branch (the default branch you get on clone, where fixes land first) and the bug still reproduces there. Please git pull the latest dev before filing.

Install Method

Docker (docker compose up)

Operating System

Linux

Steps to Reproduce

1. Configure email integration with a gmail account
2. Test the email access from the UI, emails are seen and can be deleted, email account is properly configured
3. Instruct the agent to send a test email
4. Agent says the mail is created and awaits approval
5. Search for approval UI interface and do not find any, there is no apporve button, no pending approval area, library is empty, no way to approva a email.

Expected Behaviour

any available approval UI element woluld - bUt I also plan to have an agentic research be performed regularly and the result to be sent to me by email, there msut be a way to switch off approval requirements for speciific tasks or email adresses.

Actual Behaviour

No eamil can be sent

Logs / Screenshots

Model / Backend (if relevant)

gpt 5.5 via openai subscription

Are you willing to submit a fix?

No — I am only filing the report

Additional Information

Tried to instruct the agent via text to send the email without approval - not working

[maxmilian]

Did some code-level triage on this one against current dev:

There is no email-approval mechanism in the codebase today — the "mail created and awaits approval" message from the agent doesn't correspond to any real feature. Searching dev for approval flows, the only approval concepts that exist are plan-mode (approved_plan), skills auto-approve (auto_approve_skills), and MCP OAuth consent. There is no pending-email queue, no approval data model, and no approval UI surface anywhere.

What actually gates email sending is the admin allowlist: send_email/reply_to_email are MCP email-server tools listed in NON_ADMIN_BLOCKED_TOOLS (src/tool_security.py:13-49), so non-admin users can't invoke them at all. That's likely why the send appeared to go nowhere — the model then narrated a plausible-sounding "awaits approval" state that doesn't exist.

So this is really two separable items:

1. Bug-shaped part: the agent confabulating a nonexistent approval flow instead of surfacing that the tool is admin-blocked — that's a misleading-UX problem worth fixing on its own.
2. Feature part: an actual approval queue (pending state + approve/reject UI + per-task/per-address bypass) would be net-new architecture and probably needs maintainer alignment on design before any PR.

Hope this saves the next person the code spelunking — leaving it to maintainers to re-scope/re-label.

[rbasche]

Thanks, that helps. I am logged in as the administrator/owner of this Odysseus instance, so the confusing part is why the send_email MCP tool is evaluated as non-admin.

This may indicate that the agent/MCP tool execution path loses or does not propagate the authenticated admin user context into tool_security.py. The UI account is admin, but the tool gate appears to treat the call as non-admin.

So the concrete bug may be:

1. blocked email tools are not surfaced as blocked to the user/model,
2. the agent confabulates a nonexistent approval queue,
3. and possibly the admin status is not propagated into the MCP tool invocation context.

Might be noteworthy that I am admin and the only registred user, but I renamed the user name from admin to my real name...

also this is the log from the last try to send the mail:

2026-07-15 09:14:33,739 - core.auth - INFO - Auth config loaded
2026-07-15 09:14:33,739 - core.auth - INFO - Loaded 1 session(s) from disk
2026-07-15 09:14:33,749 - src.tool_execution - INFO - Tool executed: email: list_email_accounts -> exit_code=0
2026-07-15 09:14:33,750 - core.auth - INFO - Auth config loaded
2026-07-15 09:14:33,750 - core.auth - INFO - Loaded 1 session(s) from disk
2026-07-15 09:14:33,774 - src.tool_execution - INFO - Tool executed: email: send_email -> exit_code=0
2026-07-15 09:14:33,775 - src.agent_loop - INFO - [agent-debug] round=2 model=gpt-5.5 _is_api_model=False tools_sent=0 tool_names=[] relevant_tools=['archive_email', 'ask_user', 'bulk_email', 'create_session', 'delete_email', 'list_cookbook_servers', 'list_email_accounts', 'list_emails', 'list_serve_presets', 'manage_contact', 'manage_memory', 'manage_settings', 'manage_skills', 'mark_email_read', 'read_email']
2026-07-15 09:14:33,776 - src.agent_loop - INFO - [agent-timing] round_start round=2 model=gpt-5.5 endpoint=https://chatgpt.com/backend-api/codex/responses prompt_tokens=84932 tools=0 native_tools=False timeout=300