Summary: The SessionHistory tool exports a session's persisted transcript (optionally including tool inputs and thinking) without verifying that the caller is allowed to read it. Any session could export transcripts of unrelated sessions in the same workspace, and cross-workspace exports resolve without an ownership check.
Area: Agent runtime / core
Reproduction or evidence: src/crates/assembly/core/src/agentic/tools/implementations/session_history_tool.rs:218-252 — call_impl resolves the target workspace (via CoreServiceAgentRuntime::resolve_session_workspace_paths) and calls coordinator.export_visible_persisted_session_transcript directly; no authorization check exists between workspace resolution and export. Any caller session_id can thus read another session's transcript.
Environment: BitFun version/commit 32f2427 (origin/main).
Summary: The SessionHistory tool exports a session's persisted transcript (optionally including tool inputs and thinking) without verifying that the caller is allowed to read it. Any session could export transcripts of unrelated sessions in the same workspace, and cross-workspace exports resolve without an ownership check.
Area: Agent runtime / core
Reproduction or evidence: src/crates/assembly/core/src/agentic/tools/implementations/session_history_tool.rs:218-252 — call_impl resolves the target workspace (via CoreServiceAgentRuntime::resolve_session_workspace_paths) and calls coordinator.export_visible_persisted_session_transcript directly; no authorization check exists between workspace resolution and export. Any caller session_id can thus read another session's transcript.
Environment: BitFun version/commit 32f2427 (origin/main).