[Security]: SessionHistory tool allows cross-session transcript export without authorization

Summary: The SessionHistory tool exports a session's persisted transcript (optionally including tool inputs and thinking) without verifying that the caller is allowed to read it. Any session could export transcripts of unrelated sessions in the same workspace, and cross-workspace exports resolve without an ownership check.

Area: Agent runtime / core

Reproduction or evidence: src/crates/assembly/core/src/agentic/tools/implementations/session_history_tool.rs:218-252 — call_impl resolves the target workspace (via CoreServiceAgentRuntime::resolve_session_workspace_paths) and calls coordinator.export_visible_persisted_session_transcript directly; no authorization check exists between workspace resolution and export. Any caller session_id can thus read another session's transcript.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main).

Start in src/crates/assembly/core/src/agentic/tools/implementations/session_history_tool.rs, especially call_impl around lines 218-252. Trace resolve_session_workspace_paths and coordinator.export_visible_persisted_session_transcript to understand where authorization belongs. Done means unrelated sessions and cross-workspace sessions cannot export persisted transcripts without an ownership check.

Vom Indexierungsmodell aus dem Issue-Text verfasst.