Fix workspace-scoped MCP resources/list and resources/read (#6770)

[xxiaoxiong]

Problem

MCP resources/list and resources/read call the daemon's /api/skills and /api/design-systems without forwarding the workspace headers (x-od-workspace-id, x-od-workspace-member-id). This means:

• An MCP client's resource catalog is filtered to the NO-SCOPE view — any Personal design system that the workspace actually owns is hidden.
• Reading od://design-systems/<personal-id>/DESIGN.md returns 404 design system not found, even though the binding exists under the workspace.

This differs from the project/run tools (introduced in #6569) which already resolve the signed-in workspace and forward headers on every daemon call.

Fix

1. _listMcpResources — extract the ListResourcesRequestSchema handler body into an exported helper. Inside the daemonTarget.call callback, resolve the workspace context once and pass the headers to both getJson calls for /api/skills and /api/design-systems.
2. _readMcpResource — same pattern for ReadResourceRequestSchema. The skill/design-systems branch now resolves the workspace and forwards headers so reads of Personal design systems land on the binding instead of returning 404.
3. The original stdio server.setRequestHandler bodies now delegate to the helpers (no behavioral change to the stdio path).

Tests

Added apps/daemon/tests/mcp-resources-workspace-scope.test.ts covering:

• Header forwarding on resources/list calls
• Header forwarding on resources/read for design-system URIs
• NO-SCOPE fallback when no workspace context resolves
• Brief-app resource fast-path (bypasses daemon)
• Unsupported URI rejection

Related

Closes #6770

[lefarcen]

🧪 Queued for QA validation — this PR changes live MCP resource behavior, so we'll want a manual QA pass before merge. Nothing needed from you right now; we'll pick that up once the review/CI gates are clear. Thanks for the contribution! 🙏

[lefarcen]

Hey @xxiaoxiong — the workspace-header gap and the regression coverage are both clear from the current write-up. Before pool review picks this up, could you add the user-facing outcome (What users will see), tick the relevant Surface area, and note what you actually ran under Validation? Problem already covers the why, so there's no need to rename headings.

Related: #6770 (linked bug report with the end-user repro).

[lefarcen]

One more PR-body item after this push: because this is labeled type/bugfix, could you add a short Bug fix verification note describing the failing repro seam and what confirms it now passes? The earlier asks for What users will see, Surface area, and Validation still apply.

[PerishCode]

@xxiaoxiong I reviewed the workspace-scoped MCP resource changes across both modified files. The list and read handlers now consistently reuse the existing workspace resolver, preserve the headerless fallback and brief-app fast path, and retain the stdio handler behavior through the extracted helpers. I also verified the focused regression suite (5 tests), daemon source/test typecheck, and repository guard all pass. Nice work closing this resource-catalog gap with focused coverage.

_{🔁 Powered by Looper · runner=reviewer · agent=codex · An autonomous AI dev team for your GitHub repos.}

[AmyShang-alt]

@xxiaoxiong

Thanks for the contribution. I completed QA validation for this PR.

QA Acceptance Record

Scope:

• Workspace-scoped MCP resources/list and resources/read
• Personal design-system visibility, reads, and cross-member isolation

Verified:

• Reproduced the bug on base eefe79677: the Personal design system was absent from resources/list, and resources/read failed with WORKSPACE_CONTEXT_REQUIRED
• Verified head dc7d51f84: the resource is listed and its complete DESIGN.md is readable through a real MCP stdio client
• Verified another workspace member cannot list or read the Personal design system; a forced read is rejected with 403
• Verified the signed-out path remains fail-closed
• Focused MCP tests passed (5/5), design-system workspace isolation tests passed (12/12), daemon typecheck passed, and CI is green

Not verified:

• None blocking

Risks / notes:

• The fully signed-out read returns an explicit permission-denied error rather than WORKSPACE_CONTEXT_REQUIRED, but remains fail-closed and does not expose resource content.

Conclusion:

• Accepted