fix(briefs): enforce bridge user scope

packages/plugins/plugin-briefs/src/worker.ts

@@ -340,9 +340,11 @@ async function refreshIssueTree(
   ctx: PluginContext,
   store: ReturnType<typeof createBriefsStore>,
   rawInput: Record<string, unknown>,
+  request?: PluginBridgeRequestContext,
 ) {
   const companyId = stringParam(rawInput.companyId, "companyId");
   const userId = stringParam(rawInput.userId, "userId");
+  if (request) assertTrustedBridgeUserScope(userId, request);
   const rootIssueId = stringParam(rawInput.rootIssueId, "rootIssueId");
   const card = await saveBriefCard(
     ctx,
@@ -439,16 +441,17 @@ const plugin = definePlugin({
       };
     });
 
-    ctx.actions.register("save-deterministic-card", async (params) => {
+    ctx.actions.register("save-deterministic-card", async (params, request) => {
       const input = bridgeParams(params);
       const bundle = objectParam(input.bundle, "bundle") as BriefsSourceBundle;
+      assertTrustedBridgeUserScope(stringParam(bundle.userId, "bundle.userId"), request);
       const options = (input.options && typeof input.options === "object" ? input.options : {}) as DeterministicBriefOptions;
       const card = await saveBriefCard(ctx, store, bundle, options);
       return { card };
     });
 
-    ctx.actions.register("refresh-issue-tree", async (params) => {
-      return refreshIssueTree(ctx, store, bridgeParams(params));
+    ctx.actions.register("refresh-issue-tree", async (params, request) => {
+      return refreshIssueTree(ctx, store, bridgeParams(params), request);
     });
 
     ctx.actions.register("reconcile-managed-agent", async (params) => {

packages/plugins/plugin-briefs/tests/managed-resources.spec.ts

@@ -280,6 +280,14 @@ describe("Briefs managed resources", () => {
       routineKey: BRIEFS_MANAGED_ROUTINE_KEYS[0],
       variables: { userId: "victim-user" },
     }, context)).rejects.toThrow("Briefs user scope mismatch");
+    await expect(harness.performAction("save-deterministic-card", {
+      bundle: { userId: "victim-user" },
+    }, context)).rejects.toThrow("Briefs user scope mismatch");
+    await expect(harness.performAction("refresh-issue-tree", {
+      companyId,
+      userId: "victim-user",
+      rootIssueId: "issue-1",
+    }, context)).rejects.toThrow("Briefs user scope mismatch");
   });
 
 });