feat: harden orchestrator execution runtime

capabilities.mjs

@@ -42,6 +42,45 @@ export function resolveSandboxMcpUserDataPgUrl({
   }
 }
 
+export function resolveSandboxMcpControlDbEnv(
+  sourceEnv = {},
+  {
+    containerized = false,
+    hostGateway = 'host.docker.internal',
+  } = {},
+) {
+  const resolved = {};
+  for (const key of [
+    'DATABASE_URL',
+    'MYSQL_HOST',
+    'MYSQL_PORT',
+    'MYSQL_USER',
+    'MYSQL_PASSWORD',
+    'MYSQL_DATABASE',
+    'PRIVATE_DATA_MAX_BYTES',
+  ]) {
+    if (sourceEnv[key]) resolved[key] = String(sourceEnv[key]);
+  }
+  if (!containerized) return resolved;
+
+  const gateway = String(hostGateway || 'host.docker.internal').trim();
+  if (resolved.MYSQL_HOST && LOOPBACK_PG_HOSTS.has(resolved.MYSQL_HOST.trim())) {
+    resolved.MYSQL_HOST = gateway;
+  }
+  if (resolved.DATABASE_URL) {
+    try {
+      const parsed = new URL(resolved.DATABASE_URL);
+      if (LOOPBACK_PG_HOSTS.has(parsed.hostname)) {
+        parsed.hostname = gateway;
+        resolved.DATABASE_URL = parsed.toString();
+      }
+    } catch {
+      // Keep the configured value so the MCP reports the real parse error.
+    }
+  }
+  return resolved;
+}
+
 export function resolveMindSearchMcpServerPath(overridePath) {
   const normalized = String(overridePath ?? '').trim();
   if (normalized) return normalized;
@@ -392,17 +431,16 @@ function sandboxMcpEnvs(sandboxMcp, mcpTools) {
       envs.MINDSPACE_USERDATA_AUTO_PROVISION = String(autoProvision).trim();
     }
   }
-  for (const key of [
-    'DATABASE_URL',
-    'MYSQL_HOST',
-    'MYSQL_PORT',
-    'MYSQL_USER',
-    'MYSQL_PASSWORD',
-    'MYSQL_DATABASE',
-    'PRIVATE_DATA_MAX_BYTES',
-  ]) {
-    if (process.env[key]) envs[key] = process.env[key];
-  }
+  Object.assign(
+    envs,
+    resolveSandboxMcpControlDbEnv(process.env, {
+      containerized: Boolean(sandboxMcp.containerized),
+      hostGateway:
+        sandboxMcp.controlDbHostGateway
+        ?? process.env.MINDSPACE_CONTROL_DB_MCP_HOST
+        ?? 'host.docker.internal',
+    }),
+  );
   return envs;
 }