refactor(session): clarify reference boundaries

tests/agent/tools/test_sessions.py

@@ -46,7 +46,7 @@ def _webui_request(
         channel="websocket",
         chat_id=session_key.removeprefix("websocket:"),
         session_key=session_key,
-        metadata={INBOUND_META_SESSION_READ_SCOPE: True},
+        metadata={INBOUND_META_SESSION_READ_SCOPE: "websocket:"},
     ))
 
 
@@ -284,3 +284,24 @@ async def test_session_tools_reject_unscoped_and_out_of_scope_sessions(tmp_path)
     assert spoofed.is_error
     assert [row["session_key"] for row in search["results"]] == ["websocket:visible"]
     assert read.is_error
+
+
+@pytest.mark.asyncio
+async def test_session_tools_use_the_scope_granted_by_the_channel(tmp_path):
+    manager = SessionManager(tmp_path)
+    _save_session(
+        manager,
+        "custom:history",
+        title="History",
+        messages=[{"role": "user", "content": "custom needle"}],
+    )
+
+    with request_context(RequestContext(
+        channel="custom",
+        chat_id="current",
+        session_key="custom:current",
+        metadata={INBOUND_META_SESSION_READ_SCOPE: "custom:"},
+    )):
+        result = _decode(await SearchSessionsTool(manager).execute(query="needle"))
+
+    assert [row["session_key"] for row in result["results"]] == ["custom:history"]

tests/webui/test_session_mentions.py

@@ -51,7 +51,7 @@ def test_normalize_session_mentions_keeps_only_authorized_distinct_targets(
             {"name": "STRASSE", "session_key": "websocket:upper"},
             {"name": "private", "session_key": "telegram:private"},
         ],
-        SessionAccessScope("websocket:current"),
+        SessionAccessScope("websocket:current", "websocket:"),
     )
 
     assert mentions == [
@@ -99,6 +99,7 @@ def test_restricted_scope_rejects_sessions_from_other_projects(tmp_path) -> None
     access = WebuiSessionAccess(manager)
     scope = SessionAccessScope(
         "websocket:current",
+        "websocket:",
         project_path=project_a,
         restrict_to_workspace=True,
     )