Isolate Cursor executor to admin-configured whitelist channel for H5 and WeChat.

Non-allowlisted users stay on the existing Goose/DeepSeek path; only memindadm whitelist users enter the TKMind Cursor channel on selected intents and channels.

Co-authored-by: Cursor <cursoragent@cursor.com>

wechat-cursor-executor-policy.mjs

@@ -1,17 +1,41 @@
 import {
+  CURSOR_EXECUTOR_CHANNEL,
+  isChannelAllowedByCursorPolicy,
   isIntentAllowedByWechatCursorPolicy,
   isUserAllowedByWechatCursorPolicy,
 } from './wechat-cursor-executor-admin-config.mjs';
 
+export { CURSOR_EXECUTOR_CHANNEL };
+
+export function resolveCursorChannelEligible({
+  user = null,
+  userId = null,
+  channel = '',
+  intentKind = '',
+  policy = null,
+} = {}) {
+  if (!policy?.enabled) return false;
+  const subject = user ?? { userId };
+  if (!isUserAllowedByWechatCursorPolicy(subject, policy)) return false;
+  if (!isChannelAllowedByCursorPolicy(channel, policy)) return false;
+  const normalizedChannel = String(channel ?? '').trim().toLowerCase();
+  if (normalizedChannel === CURSOR_EXECUTOR_CHANNEL.WECHAT_MP) {
+    if (!isIntentAllowedByWechatCursorPolicy(intentKind, policy)) return false;
+  }
+  return true;
+}
+
 export function resolveWechatCursorExecutorEligible({
   user = null,
   userId = null,
   intentKind = '',
   policy = null,
 } = {}) {
-  if (!policy?.enabled) return false;
-  const subject = user ?? { userId };
-  if (!isUserAllowedByWechatCursorPolicy(subject, policy)) return false;
-  if (!isIntentAllowedByWechatCursorPolicy(intentKind, policy)) return false;
-  return true;
+  return resolveCursorChannelEligible({
+    user,
+    userId,
+    channel: CURSOR_EXECUTOR_CHANNEL.WECHAT_MP,
+    intentKind,
+    policy,
+  });
 }