fix: confine Agent and MCP data access

hub/test/integration/real-model.test.ts

@@ -9,7 +9,7 @@
 import { describe, it, expect } from "vitest";
 import { mkdtemp, rm } from "node:fs/promises";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import "dotenv/config";
 import { runAgent } from "../../src/agent/runner.js";
 import type { PrismaClient } from "@prisma/client";
@@ -47,7 +47,12 @@ describeOrSkip("real model integration (OpenRouter)", () => {
         sessionId: "real-test-session",
         prompt: "请只回复: OK",
         model: MODEL,
-        project: { projectId: "real-test-project", boundChatId: "chat-test", workspaceDir: workspace },
+        project: {
+          projectId: "real-test-project",
+          boundChatId: "chat-test",
+          workspaceRoot: dirname(workspace),
+          workspaceDir: workspace,
+        },
         prisma: stubPrisma,
         systemPrompt: "你是一个极简 smoke test 助手。请严格按用户要求回复。",
         maxTurns: 3,