feat: finalize mindspace service extraction phase a

user-auth.mjs

@@ -25,20 +25,21 @@ import {
   resolvePolicies,
 } from './policies.mjs';
 import {
-  buildPublicUrl,
   ensurePublishSkillInstalled,
   ensureUserPublishLayout,
   ensureWorkspaceHintsInstalled,
   PUBLISH_SKILL_NAME,
-  resolvePublicBaseUrl,
   resolveLegacyPublishDir,
-  resolveGoosedSandboxRoot,
 } from './user-publish.mjs';
 import {
   ensureUserSpaceLayout,
   isPathInsideUserWorkspace,
-  resolveMindspaceStorageRoot,
 } from './user-space.mjs';
+import {
+  buildMindSpacePublicUrlForUser,
+  resolveMindSpaceAgentWorkspaceCapability,
+  resolveMindSpaceRuntimeConfig,
+} from './mindspace-runtime-config.mjs';
 import { ensureUserMemoryProfile } from './user-memory-profile.mjs';
 import {
   applySkillGrantsToCapabilities,
@@ -125,8 +126,7 @@ export function createUserAuth(pool, options = {}) {
   const usersRoot = path.resolve(options.usersRoot ?? '/tmp/tkmind_go_users');
   const h5Root = path.resolve(options.h5Root ?? path.join(usersRoot, '..'));
   const env = options.env ?? process.env;
-  const storageRoot = resolveMindspaceStorageRoot(h5Root, env);
-  const publicBaseUrl = resolvePublicBaseUrl(env);
+  const { storageRoot, publicBaseUrl } = resolveMindSpaceRuntimeConfig(h5Root, env);
   const skillCatalog = listPlatformSkillCatalog(h5Root);
   const defaultSignupBalanceCents = Number(options.defaultSignupBalanceCents ?? 500);
   const lowBalanceGiftThresholdCents = Number(options.lowBalanceGiftThresholdCents ?? 100);
@@ -228,7 +228,7 @@ export function createUserAuth(pool, options = {}) {
     return {
       ...base,
       publishSlug: publishKey,
-      publishUrl: buildPublicUrl(publicBaseUrl, publishKey),
+      publishUrl: buildMindSpacePublicUrlForUser({ h5Root, env, user: publishKey }),
       publishSkillName: PUBLISH_SKILL_NAME,
     };
   };
@@ -1826,17 +1826,23 @@ export function createUserAuth(pool, options = {}) {
     let sandboxMcp = null;
     if (effectiveCapabilities.static_publish || effectiveCapabilities.private_data_space) {
       try {
-        const layout = await publishLayoutFor(user, { migrateLegacy: false });
+        const workspaceCapability = resolveMindSpaceAgentWorkspaceCapability({
+          h5Root,
+          env,
+          user,
+        });
         sandboxMcp = {
           // When goosed runs in a container its filesystem is split from the portal's,
           // so the host paths the portal would otherwise send (node binary, MCP script)
           // are not resolvable. These env overrides let the portal send container-canonical
           // paths instead. Unset (e.g. local dev, co-located native goosed) => fall back to
           // the portal's own paths, so behavior is unchanged.
-          serverPath: resolveSandboxMcpServerPath(process.env.GOOSED_MCP_SERVER_PATH),
-          sandboxRoot: resolveGoosedSandboxRoot(h5Root, user),
+          serverPath: resolveSandboxMcpServerPath(env.GOOSED_MCP_SERVER_PATH),
+          sandboxRoot: workspaceCapability.sandboxRoot,
+          workspaceRoot: workspaceCapability.workspaceRoot,
+          workspaceRef: workspaceCapability.workspaceRef,
           userId: user.id,
-          nodeExecPath: process.env.GOOSED_MCP_NODE_PATH,
+          nodeExecPath: env.GOOSED_MCP_NODE_PATH,
         };
       } catch (err) {
         console.warn('[getAgentSessionPolicy] sandbox MCP setup failed, falling back:', err?.message);