Isolate Cursor executor to admin-configured whitelist channel for H5 and WeChat.

Non-allowlisted users stay on the existing Goose/DeepSeek path; only memindadm whitelist users enter the TKMind Cursor channel on selected intents and channels.

Co-authored-by: Cursor <cursoragent@cursor.com>

wechat-cursor-executor-policy.test.mjs

@@ -2,10 +2,15 @@ import test from 'node:test';
 import assert from 'node:assert/strict';
 import {
   createWechatCursorExecutorAdminConfigService,
+  isChannelAllowedByCursorPolicy,
   isUserAllowedByWechatCursorPolicy,
   isIntentAllowedByWechatCursorPolicy,
 } from './wechat-cursor-executor-admin-config.mjs';
-import { resolveWechatCursorExecutorEligible } from './wechat-cursor-executor-policy.mjs';
+import {
+  CURSOR_EXECUTOR_CHANNEL,
+  resolveCursorChannelEligible,
+  resolveWechatCursorExecutorEligible,
+} from './wechat-cursor-executor-policy.mjs';
 
 function createMemoryPool() {
   const rows = new Map();
@@ -89,3 +94,57 @@ test('isIntentAllowedByWechatCursorPolicy respects allowlist', () => {
   assert.equal(isIntentAllowedByWechatCursorPolicy('page.generate', policy), true);
   assert.equal(isIntentAllowedByWechatCursorPolicy('chat.general', policy), false);
 });
+
+test('H5 channel does not require intent allowlist', async () => {
+  const pool = createMemoryPool();
+  const service = createWechatCursorExecutorAdminConfigService(pool);
+  await service.updateAdminConfig({
+    enabled: true,
+    userAllowlist: ['john-uuid'],
+    channelAllowlist: ['h5', 'wechat_mp'],
+  }, { updatedBy: 'admin-1' });
+  const policy = await service.getEffectivePolicy('john-uuid', { userId: 'john-uuid' });
+  assert.equal(
+    resolveCursorChannelEligible({
+      user: { userId: 'john-uuid' },
+      channel: CURSOR_EXECUTOR_CHANNEL.H5,
+      policy,
+    }),
+    true,
+  );
+});
+
+test('H5 channel respects channelAllowlist', async () => {
+  const pool = createMemoryPool();
+  const service = createWechatCursorExecutorAdminConfigService(pool);
+  await service.updateAdminConfig({
+    enabled: true,
+    userAllowlist: ['john-uuid'],
+    channelAllowlist: ['wechat_mp'],
+  }, { updatedBy: 'admin-1' });
+  const policy = await service.getEffectivePolicy('john-uuid', { userId: 'john-uuid' });
+  assert.equal(
+    resolveCursorChannelEligible({
+      user: { userId: 'john-uuid' },
+      channel: CURSOR_EXECUTOR_CHANNEL.H5,
+      policy,
+    }),
+    false,
+  );
+  assert.equal(
+    resolveCursorChannelEligible({
+      user: { userId: 'john-uuid' },
+      channel: CURSOR_EXECUTOR_CHANNEL.WECHAT_MP,
+      intentKind: 'page.generate',
+      policy,
+    }),
+    true,
+  );
+});
+
+test('isChannelAllowedByCursorPolicy defaults to both channels', () => {
+  const policy = { channelAllowlist: ['h5', 'wechat_mp'] };
+  assert.equal(isChannelAllowedByCursorPolicy('h5', policy), true);
+  assert.equal(isChannelAllowedByCursorPolicy('wechat_mp', policy), true);
+  assert.equal(isChannelAllowedByCursorPolicy('other', policy), false);
+});