fix: confine Agent and MCP data access

hub/src/feishu/download.ts

@@ -13,7 +13,7 @@ export interface DownloadedFeishuMessageResource extends FeishuMessageResourceAr
   readonly path: string;
 }
 
-type DownloadContext = Pick<ToolContext, "boundChatId" | "workspaceDir">;
+type DownloadContext = Pick<ToolContext, "boundChatId" | "workspaceDir"> & { readonly workspaceRoot: string };
 
 interface MessageLookupResult {
   readonly data?: {
@@ -36,18 +36,29 @@ export async function downloadFeishuMessageResource(
     throw new Error(`Feishu message not found: ${args.messageId}`);
   }
   if (message.chat_id !== context.boundChatId) {
+    rt.logger.warn(
+      { messageId: args.messageId, boundChatId: context.boundChatId, returnedChatId: message.chat_id },
+      "Feishu resource download refused outside bound chat",
+    );
     throw new Error(
       `refused Feishu resource download: message ${args.messageId} is not in the current project's bound chat`,
     );
   }
 
   const extension = args.resourceType === "image" ? ".png" : ".bin";
-  const savePath = join(
-    context.workspaceDir,
+  const workspaceRelativePath = join(
     ".cph",
     "inbox",
     `feishu-${args.resourceType}-${randomUUID()}${extension}`,
   );
-  await downloadMessageFile(rt, args.messageId, args.fileKey, savePath, args.resourceType);
+  const savePath = await downloadMessageFile(
+    rt,
+    args.messageId,
+    args.fileKey,
+    context.workspaceRoot,
+    context.workspaceDir,
+    workspaceRelativePath,
+    args.resourceType,
+  );
   return { ...args, path: savePath };
 }