fix(server): close the tool_call record on a direct-mode sanitisation block

Direct routing (#1685) returned applyOutputSanitisation's block result before
emitting the call's completion. It now emits the same error tool_call
(error_class proxy_policy, block message only) as the call_tool_* paths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: Dumbris

internal/server/mcp_routing.go

@@ -745,6 +745,11 @@ func (p *MCPProxyServer) makeDirectModeHandler(entry *directCatalogEntry) mcpser
 		// applied to /mcp/all. Applied to the RAW result before the activity
 		// classification and truncation below; a non-nil result means blocked.
 		if blockResult := p.applyOutputSanitisation(ctx, serverName, toolName, requestID, directContentTrust, result); blockResult != nil {
+			// The upstream ran, so the started record is closed with the block
+			// message, never the response (direct mode keeps no history).
+			blockMsg := firstTextOf(blockResult)
+			callerr.NoteOutcome(ctx, callerr.Outcome{Class: callerr.ClassProxyPolicy, Domain: callerr.DomainProxy})
+			p.emitActivityToolCallCompleted(ctx, serverName, toolName, sessionID, requestID, "mcp", "error", blockMsg, durationMs, enrichedArgs, "", false, contracts.DeriveCallWith(annotations), nil, directContentTrust, "", 0, 0, "", nil, "")
 			return blockResult, nil
 		}
 

internal/server/sanitisation_block_completion_test.go

@@ -108,6 +108,15 @@ func TestLegacyCallTool_SanitisationBlockRecordsToolCallCompletion(t *testing.T)
 	assertBlockedCallRecorded(t, f)
 }
 
+func TestDirectMode_SanitisationBlockRecordsToolCallCompletion(t *testing.T) {
+	f := blockedSecretFixture(t)
+	res := f.call(t, fullTierAgentOn("github"), "github", "get_secret")
+	require.True(t, res.IsError)
+	require.Equal(t, int64(1), f.ups["github"].count.Load(), "the upstream ran")
+
+	assertBlockedCallRecorded(t, f)
+}
+
 // The tool-call history entry of a blocked call keeps the attempt but never
 // the response: the block message takes its place. (The direct-routing
 // fixture's incarnation guard drops every history write, so this is checked