Summary: SessionControl's list action accepts an explicit workspace argument and enumerates every session in it without checking whether the caller session belongs to that workspace. A delegated session can therefore enumerate other workspaces' session summaries (ids, names, activity times).
Area: Agent runtime / core
Reproduction or evidence: src/crates/assembly/core/src/agentic/tools/implementations/session_control_tool.rs:653-692 — the List branch resolves the effective workspace (resolve_effective_workspace, which for List accepts any workspace argument) and calls runtime.list_sessions directly; no caller-ownership check exists between resolution and enumeration.
Environment: BitFun version/commit 32f2427 (origin/main).
Summary: SessionControl's list action accepts an explicit
workspaceargument and enumerates every session in it without checking whether the caller session belongs to that workspace. A delegated session can therefore enumerate other workspaces' session summaries (ids, names, activity times).Area: Agent runtime / core
Reproduction or evidence: src/crates/assembly/core/src/agentic/tools/implementations/session_control_tool.rs:653-692 — the List branch resolves the effective workspace (resolve_effective_workspace, which for List accepts any workspace argument) and calls runtime.list_sessions directly; no caller-ownership check exists between resolution and enumeration.
Environment: BitFun version/commit 32f2427 (origin/main).