(CODUX-202) Enforce authenticated agent scope for persistent skill retrieval

[numnx]

🧩 Task: Enforce authenticated agent scope for persistent skill retrieval

Automated task PR opened by Code UX for T07.

📋 Summary

Sprint: Sprint 202 · Persistent Skills + Agents UX Cleanup · Task: T07

Complete persistent skill runtime context and deliver a modular, accessible Agents settings workflow with discoverable storage contents and management.

🤖 Model & Provider

Provider	Codex CLI
Model	gpt-5.6-sol

⏱️ Timing

Started	2026-07-10 22:14:48 UTC
Finished	2026-07-10 22:19:10 UTC
Duration	4m 22s

📊 Token Usage

Metric	Value
Input tokens	81,470
Cached input tokens	1,292,032
Output tokens	7,859
Total tokens	1,381,361
Invocations	1
Tool calls	18
Active time	3m 57s

Included usage estimate (subscription/local login): $1.29

✅ QA Review

⏳ QA review runs after this PR is opened. Check the task card in the dashboard for the outcome once it lands.

📝 Full Task Prompt

## Objective
Close the persistent-skill retrieval authorization gap identified during sprint QA.

## Scope
- `src/mcp/management/skill-actions.ts`
- `src/mcp/management-tool-handler.ts` or equivalent MCP context boundary
- `src/services/skill-service.ts`
- Focused backend MCP/runtime tests

## Requirements
1. Propagate the authenticated MCP agent identity into `search_skills` handling.
2. For agent-scoped requests, verify the agent belongs to the requested project.
3. Ignore or reject mismatched caller-supplied `agentPresetId` values.
4. Resolve search storage IDs exclusively from the agent’s enabled project-owned attachments; reject direct `storageId` values outside that set.
5. Preserve existing unscoped project-manager search behavior.
6. Add regression tests for attached storage access, omitted agent scope, mismatched agent IDs, unrelated storage IDs, and project mismatch.

## Verification
- Run the focused MCP and persistent-skills runtime tests.
- Run `pnpm run lint`.
- Run `pnpm run build`.

🌿 Branch Info

Base: feature/CODUX-202-persistent-skills-agents-ux-cleanup
Head: task/feature-codux-20-t07-codex-4fedb099-mrfhu89l

---

🤖 Generated by Code UX