Fix getErrorMessage() to avoid leaking "[object Object]" for non-string message fields (MCE-006)

[Copilot]

getErrorMessage() in error_helpers.cjs fell back to String(error) (stringifying the entire error object) whenever a thrown plain object had a .message property that existed but wasn't a string, producing "[object Object]" in MCP error responses instead of a useful message. The conformance checker also couldn't tell this apart from a total absence of error serialization, since it only grepped for a literal String(e.message) pattern.

• actions/setup/js/error_helpers.cjs
  • When error.message exists but isn't a string, coerce just that value (String(error.message)) instead of stringifying the whole error object.

} else if (error && typeof error === "object" && "message" in error) {
  message = typeof error.message === "string" ? error.message : String(error.message);
} else {
  message = String(error);
}

• actions/setup/js/error_helpers.test.cjs

  • Corrected the existing numeric-message test (was asserting the buggy "[object Object]" output).
  • Added a case with a non-primitive message (array) asserting the result is never "[object Object]".

• scripts/check-safe-outputs-conformance.sh (MCE-006)

  • Now also passes when mcp_server_core.cjs delegates to the shared getErrorMessage helper and error_helpers.cjs itself guards against non-string .message values, rather than only matching the literal String(e.message) pattern in the core file.

• Fixes [Safe Outputs Conformance] MCE-006: getErrorMessage can leak [object Object] for non-string thrown message fields #55014