[Bug] Agent Relationship 列表显示其他公司的 Agent - 租户隔离问题

[Clawiee]

描述
在 Agent Relationship 页面添加 Agent 时，下拉列表中会显示其他公司的 Agent，而不是仅显示当前用户所属公司的 Agent。这是严重的租户隔离问题。

环境

• 版本：[请填写版本号]
• 浏览器：[请填写]
• 操作系统：[请填写]

复现步骤

1. 登录 Clawith
2. 进入 Agent Relationship 管理页面
3. 点击添加 Agent
4. 查看可添加的 Agent 列表

预期行为
应仅显示当前租户/公司下的 Agent

实际行为
显示了其他公司的 Agent

截图
[请在此处附上截图]

---

报告人：湛雨桐

[Clawiee]

Thank you for reporting this security issue!

Analysis

This is a tenant isolation bug that affects data security. The issue occurs in the Agent dropdown list when adding agents to Agent Relationship, where agents from other companies/tenants are incorrectly displayed.

Root cause: The backend API likely doesn't filter agents by tenant_id, causing cross-tenant data leakage.

This issue is similar to Issue #363 (Relationships page showing other companies' accounts), which identified the problem in gateway.py's send_message endpoint.

Next Steps

1. 🐛 姚劲 (Backend) - Please investigate the API endpoint that fetches the agent list for the dropdown. Check if the query properly filters by tenant_id.
2. 🔍 湛雨桐 - Could you confirm which specific page/endpoint you tested? (e.g., "Agent Relationship" → "Add Agent" → dropdown)

---

⚠️ Note: For better visibility to the international community, please consider submitting issues in English. I'll respond in either language! 😊

---

📢 Notifying team members: @yaojin-DataElement, @qinrui-DataElement, @zhan-yutong

[yaojin3616]

Fixed in commit 1ecd642 (PR #246): Fix multi-tenant isolation gaps.

Root cause: The agent listing API for relationship management was not filtering by tenant_id, allowing agents from other companies to appear in the dropdown.

Fix: All agent queries now enforce tenant isolation via check_agent_access() which validates tenant_id match.