fix: confine Agent and MCP data access

hub/src/feishu/read.ts

@@ -48,12 +48,15 @@ function im(rt: FeishuRuntime): ImV1Message {
 /** Read on-demand Feishu context for the current run. Entry point for the tool. */
 export async function readFeishuContext(
   args: FeishuContextArgs,
-  _ctx: ToolContext,
+  ctx: ToolContext,
   rt: unknown,
 ): Promise<string> {
   const runtime = rt as FeishuRuntime;
   const api = im(runtime);
   try {
+    if (args.chat_id !== ctx.boundChatId) {
+      throw new Error("refused Feishu context read outside the current project's bound chat");
+    }
     switch (args.anchor) {
       case "trigger_message":
       case "status_card":
@@ -62,6 +65,7 @@ export async function readFeishuContext(
         const res = await api.get({ path: { message_id: args.id } });
         const msg = res.data?.message ?? res.data?.items?.[0];
         if (msg === undefined) return JSON.stringify({ error: "message not found", id: args.id });
+        assertBoundChat(msg, ctx.boundChatId);
         return JSON.stringify(compact(msg));
       }
       case "thread": {
@@ -75,16 +79,33 @@ export async function readFeishuContext(
           },
         });
         const items = res.data?.items ?? [];
+        for (const item of items) assertBoundChat(item, ctx.boundChatId);
         return JSON.stringify(items.map(compact));
       }
       default:
         return JSON.stringify({ error: `unknown anchor type: ${args.anchor as string}` });
     }
   } catch (e) {
+    runtime.logger.warn(
+      {
+        runId: ctx.runId,
+        projectId: ctx.projectId,
+        anchor: args.anchor,
+        anchorId: args.id,
+        err: e instanceof Error ? e.message : String(e),
+      },
+      "Feishu context read refused or failed",
+    );
     return JSON.stringify({ error: e instanceof Error ? e.message : String(e) });
   }
 }
 
+function assertBoundChat(message: LarkMessage, boundChatId: string): void {
+  if (message.chat_id !== boundChatId) {
+    throw new Error("refused Feishu context result outside the current project's bound chat");
+  }
+}
+
 /** Project a lark message down to the fields the model actually needs. */
 function compact(m: LarkMessage): Record<string, unknown> {
   const parentId = m.parent_id ?? m.parent_message_id;