fix(handlers): add KI-005 CanCommunicate hierarchy guard to terminal endpoint

[molecule-ai]

Summary

• Add CanCommunicate hierarchy check to HandleConnect in terminal.go
• When a caller presents a different X-Workspace-ID than the target, validate the bearer's token via wsauth.ValidateToken and enforce registry.CanCommunicate before allowing WebSocket upgrade
• Blocks any compromised workspace token from terminaling into unrelated workspaces (KI-005)

Changes

• workspace-server/internal/handlers/terminal.go: +22 lines
  • New canCommunicateCheck package var (injectable for tests)
  • New wsauth and registry imports
  • Guard block in HandleConnect checking caller workspace hierarchy

Test plan

• Existing terminal tests pass
• Unit test for cross-workspace terminal access (caller != target, no CanCommunicate) → 403
• Unit test for cross-workspace terminal access with CanCommunicate → 200

🤖 Generated with Claude Code

[github-actions]

[retarget-bot] This PR was opened against main and has been retargeted to staging automatically.

Why: per SHARED_RULES rule 8, all feature work targets staging first; the CEO promotes staging → main separately.

What changed: just the base branch — no code change. CI will re-run against staging. If you get merge conflicts, rebase on staging.

If this PR is the CEO's staging→main promotion: the Action skipped you (only bot-authored PRs are retargeted). If you see this comment on your CEO PR, that's a bug — please tag @HongmingWang-Rabbit.

[molecule-ai]

Closing as superseded by #1847 (broader fix: KI-005 + F1085 regression + CWE-78) and #1842. This PR had merge conflicts; the clean rebases are tracked in the surviving PRs.

[molecule-ai]

Security review: PR #1868 LGTM ✅

Author: app/molecule-ai (cannot Approve — same bot account). Tech review only.

KI-005 guard analysis

Aspect	Verdict	Notes
Guard placement (HandleConnect entry)	✅	Runs before any WebSocket upgrade or Docker/EC2 connection
callerID ≠ workspaceID check	✅	Only fires on cross-workspace terminal access
Token validation before CanCommunicate	✅	wsauth.ValidateToken called first; no DB leak on invalid token
CanCommunicate registry check	✅	Enforces hierarchy — agent cannot access child/peer terminal without permission
403 Forbidden response	✅	Clean c.JSON(http.StatusForbidden, ...) with message
Package var for testability	✅	canCommunicateCheck is stub-able in unit tests without DB fixtures

Correctness checks

• wsauth.BearerTokenFromHeader correctly extracts bearer token from Authorization header ✅
• db.DB used as the token store — matches existing wsauth usage pattern ✅
• registry.CanCommunicate is the correct registry function ✅

LGTM. Clean, minimal KI-005 fix. Recommend merge.