mindspace: close authority boundaries

user-auth.mjs

@@ -1859,7 +1859,14 @@ export function createUserAuth(pool, options = {}) {
     };
   };
 
-  const getAgentSessionPolicy = async (userId, { toolMode = 'chat' } = {}) => {
+  const getAgentSessionPolicy = async (
+    userId,
+    {
+      toolMode = 'chat',
+      sessionId = null,
+      packageId = null,
+    } = {},
+  ) => {
     const user = await getUserById(userId);
     if (!user) throw new Error('用户不存在');
     const capabilityState = await resolveUserCapabilities(user);
@@ -1915,6 +1922,21 @@ export function createUserAuth(pool, options = {}) {
           sandboxRoot: workspaceCapability.sandboxRoot,
           workspaceRoot: workspaceCapability.workspaceRoot,
           workspaceRef: workspaceCapability.workspaceRef,
+          sessionId:
+            String(sessionId ?? '').trim() ||
+            null,
+          packageId:
+            String(packageId ?? '').trim() ||
+            (String(sessionId ?? '').trim()
+              ? `cp_${String(
+                  sessionId,
+                ).trim()}`
+              : null),
+          mcpBaseUrl:
+            env.MINDSPACE_MCP_BASE_URL ??
+            env.MINDSPACE_REMOTE_BASE_URL,
+          mcpTokenSecret:
+            env.MINDSPACE_MCP_TOKEN_SECRET,
           userId: user.id,
           nodeExecPath: env.GOOSED_MCP_NODE_PATH,
           containerized,
@@ -1952,8 +1974,14 @@ export function createUserAuth(pool, options = {}) {
     };
   };
 
-  const getCodeAgentSessionPolicy = async (userId) =>
-    getAgentSessionPolicy(userId, { toolMode: 'code' });
+  const getCodeAgentSessionPolicy = async (
+    userId,
+    scope = {},
+  ) =>
+    getAgentSessionPolicy(userId, {
+      ...scope,
+      toolMode: 'code',
+    });
 
   const getRoleCapabilities = async (role = 'user') => {
     const roleDefaults = await listCapabilityGrants('role', role);