[Security]: SessionHistory tool allows cross-session transcript export without authorization

Summary: The SessionHistory tool exports a session's persisted transcript (optionally including tool inputs and thinking) without verifying that the caller is allowed to read it. Any session could export transcripts of unrelated sessions in the same workspace, and cross-workspace exports resolve without an ownership check.

Area: Agent runtime / core

Reproduction or evidence: src/crates/assembly/core/src/agentic/tools/implementations/session_history_tool.rs:218-252 — call_impl resolves the target workspace (via CoreServiceAgentRuntime::resolve_session_workspace_paths) and calls coordinator.export_visible_persisted_session_transcript directly; no authorization check exists between workspace resolution and export. Any caller session_id can thus read another session's transcript.

Environment: BitFun version/commit 32f2427697ee16f253ee6119860a03255c0b3e47 (origin/main).

src/crates/assembly/core/src/agentic/tools/implementations/session_history_tool.rs から始め、特に 218-252 行付近の call_impl を確認してください。resolve_session_workspace_paths と coordinator.export_visible_persisted_session_transcript をたどり、認可をどこに置くべきかを理解してください。無関係なセッションや別の workspace のセッションが、所有権チェックなしに永続化されたトランスクリプトをエクスポートできなければ完了です。

索引モデルが issue の本文から書いたものです。