fix(security): scope skill assignments by company

src/main/skills/auto-assign-on-hire.ts

@@ -72,7 +72,7 @@ export function autoAssignSkillsForHire(
     return { assignedSkillIds: [] };
   }
 
-  const alreadyAssigned = new Set(db.core.skills.listAgentSkillAssignments(input.agentId));
+  const alreadyAssigned = new Set(db.core.skills.listAgentSkillAssignments(input.companyId, input.agentId));
   const wanted = new Set(categories);
   const catalogue = db.core.skills.listCompanySkills(input.companyId);
 
@@ -81,8 +81,9 @@ export function autoAssignSkillsForHire(
     if (alreadyAssigned.has(skill.id)) continue;
     const category = readBuiltinCategory(skill.metadata);
     if (!category || !wanted.has(category)) continue;
-    db.core.skills.assignSkillToAgent(input.agentId, skill.id);
-    assigned.push(skill.id);
+    if (db.core.skills.assignSkillToAgent(input.companyId, input.agentId, skill.id)) {
+      assigned.push(skill.id);
+    }
   }
 
   return { assignedSkillIds: assigned };

src/main/skills/crud.ts

@@ -58,16 +58,20 @@ export function createSkillCrud({ db, logger, cleanupSkillFiles, parseGitHubUrl
   ): DesktopResult<void> {
     const skill = db.core.skills.getCompanySkill(companyId, skillId);
     if (!skill) return fail("not_found", `Skill ${skillId} not found for company`);
-    db.core.skills.assignSkillToAgent(agentId, skillId);
+    if (!db.core.skills.assignSkillToAgent(companyId, agentId, skillId)) {
+      return fail("not_found", `Agent ${agentId} not found for company`);
+    }
     return ok(undefined);
   }
 
   function removeFromAgent(
-    _companyId: string,
+    companyId: string,
     agentId: string,
     skillId: string,
   ): DesktopResult<void> {
-    db.core.skills.removeSkillFromAgent(agentId, skillId);
+    if (!db.core.skills.removeSkillFromAgent(companyId, agentId, skillId)) {
+      return fail("not_found", `Skill assignment not found for company`);
+    }
     return ok(undefined);
   }
 

src/main/skills/runtime.ts

@@ -35,7 +35,7 @@ export function createSkillRuntime({ db, logger, skillsRoot, skillFilesDir, impo
     agentId: string,
     _connectorId: string,
   ): ProjectedSkill[] {
-    const assignedIds = new Set(db.core.skills.listAgentSkillAssignments(agentId));
+    const assignedIds = new Set(db.core.skills.listAgentSkillAssignments(companyId, agentId));
     if (assignedIds.size === 0) return [];
     const companySkills = db.core.skills.listCompanySkills(companyId);
     const skillPaths = companySkills