fix(permissions): 🧭 detect missing storage buckets in queryPermissions

[binggg]

Summary

• validate storage bucket existence against env metadata before queryPermissions(action="getResourcePermission") returns a success payload
• add explicit error field to permission error envelopes so RESULT.json can preserve failure semantics directly
• add a regression test covering nonexistent storage buckets

Attribution

• issue: issue_mnoyd73x_516z19
• representative run: atomic-js-none-describe-storage-acl-not-found/2026-04-07T18-26-55-ymwnt3

Verification

• cd mcp && npx vitest run src/tools/permissions.storage-not-found.test.ts
• cd mcp && npx vitest run src/tools/permissions.test.ts src/tools/permissions.storage-not-found.test.ts
• cd mcp && npm run build
• report-api evaluation: atomic-js-none-describe-storage-acl-not-found/2026-04-08T02-45-41-d59647 (RESULT.json error check now passes; remaining failure is grader/environment mismatch because direct DescribeStorageSafeRule still returns READONLY for the fake bucket outside MCP code)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3fe5ae0e2d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Treat empty bucket lists as missing resources

This condition bypasses validation whenever getEnvInfo() returns no Storages/StaticStorages, so in fresh or storage-disabled environments queryPermissions(action="getResourcePermission", resourceType="storage") still falls through to describeResourcePermission and can report a fake bucket as readable. That leaves the original false-success behavior in place for a real runtime scenario; after a successful getEnvInfo() call, an empty inventory should be handled as “bucket not found” (or at least as an explicit validation failure) rather than skipped.

Useful? React with 👍 / 👎.