fix: connect Page Data sandbox to user PostgreSQL

capabilities.test.mjs

@@ -10,6 +10,7 @@ import {
   normalizeCapabilityPatch,
   resolveSandboxMcpNodeExecPath,
   resolveSandboxMcpServerPath,
+  resolveSandboxMcpUserDataPgUrl,
   sandboxDeveloperTools,
   sandboxMcpTools,
 } from './capabilities.mjs';
@@ -28,6 +29,30 @@ test('resolveSandboxMcpServerPath honors container-path override without host fs
   );
 });
 
+test('resolveSandboxMcpUserDataPgUrl rewrites a portal loopback URL for container MCP access', () => {
+  const resolved = resolveSandboxMcpUserDataPgUrl({
+    portalUrl: 'postgresql://mindspace:secret@127.0.0.1:5433/mindspace_userdata_prod',
+    containerized: true,
+  });
+  const parsed = new URL(resolved);
+  assert.equal(parsed.hostname, 'host.docker.internal');
+  assert.equal(parsed.port, '5433');
+  assert.equal(parsed.pathname, '/mindspace_userdata_prod');
+});
+
+test('resolveSandboxMcpUserDataPgUrl preserves native URLs and honors an explicit MCP URL', () => {
+  const portalUrl = 'postgresql://mindspace:secret@127.0.0.1:5433/mindspace_userdata_prod';
+  assert.equal(resolveSandboxMcpUserDataPgUrl({ portalUrl }), portalUrl);
+  assert.equal(
+    resolveSandboxMcpUserDataPgUrl({
+      portalUrl,
+      mcpUrl: 'postgresql://mindspace:secret@pg-proxy.internal:6432/mindspace_userdata_prod',
+      containerized: true,
+    }),
+    'postgresql://mindspace:secret@pg-proxy.internal:6432/mindspace_userdata_prod',
+  );
+});
+
 test('resolveSandboxMcpNodeExecPath honors container-path override without host fs checks', () => {
   assert.equal(resolveSandboxMcpNodeExecPath('/usr/local/bin/node'), '/usr/local/bin/node');
   assert.equal(resolveSandboxMcpNodeExecPath(''), process.execPath);
@@ -274,11 +299,18 @@ test('private_data_space alone exposes private data tools through sandbox MCP',
       serverPath: '/opt/h5/mindspace-sandbox-mcp.mjs',
       sandboxRoot: '/opt/h5/MindSpace/user-1',
       userId: 'user-1',
+      containerized: true,
+      userDataBackend: 'postgres',
+      userDataPgUrl: 'postgresql://mindspace:secret@127.0.0.1:5433/mindspace_userdata_prod',
+      userDataAutoProvision: '1',
     },
   });
   const sandboxExt = policy.extensionOverrides.find((ext) => ext.name === 'sandbox-fs');
   assert.ok(sandboxExt);
   assert.equal(sandboxExt.envs.PRIVATE_DATA_USER_ID, 'user-1');
+  assert.equal(new URL(sandboxExt.envs.MINDSPACE_USERDATA_PG_URL).hostname, 'host.docker.internal');
+  assert.equal(sandboxExt.envs.MINDSPACE_USERDATA_BACKEND, 'postgres');
+  assert.equal(sandboxExt.envs.MINDSPACE_USERDATA_AUTO_PROVISION, '1');
   assert.deepEqual(sandboxExt.available_tools, [
     'private_data_info',
     'private_data_schema',