Method BuildAgentBootstrap

internal/server/handlers_bootstrap.go:422–651

BuildAgentBootstrap assembles the bootstrap blob from store queries. This is the single canonical code path; the HTTP handler, the MCP resource handler, and the MCP `pad_set_workspace` embed all call this. r is the live request — used for the dashboard sub-build AND to resolve the calling principal

(workspaceID string, user *models.User, r *http.Request)

// safe ONLY for callers that have already verified full-member access
// out-of-band. Production HTTP/MCP paths MUST pass the live request.
func (s *Server) BuildAgentBootstrap(workspaceID string, user *models.User, r *http.Request) (*AgentBootstrap, error) {
	ws, err := s.store.GetWorkspaceByID(workspaceID)
	if err != nil {
		return nil, err
	}

	out := &AgentBootstrap{
		Workspace: AgentBootstrapWorkspace{
			ID:          ws.ID,
			Slug:        ws.Slug,
			Name:        ws.Name,
			Description: ws.Description,
		},
	}
	if user != nil {
		out.User = AgentBootstrapUser{
			ID:    user.ID,
			Name:  user.Name,
			Email: user.Email,
		}
	}

	// Resolve visibility once so collections/conventions/playbooks/roles
	// all project the same authorized view. nil visibleIDs means "no
	// restriction" — a full workspace member (or a nil-r caller that
	// has already verified access out-of-band). For guests with
	// item-level grants, we also need ItemIDs filtering so a grant to
	// one specific playbook doesn't leak the whole collection.
	var visibleIDs []string
	var grantedItemIDs []string
	var fullCollIDs []string
	if r != nil {
		visibleIDs, err = s.visibleCollectionIDs(r, workspaceID)
		if err != nil {
			return nil, err
		}
		fullCollIDs, grantedItemIDs, err = s.guestResourceFilter(r, workspaceID)
		if err != nil {
			return nil, err
		}
	}

	// Collections — load and apply visibility filtering. We hold these
	// in their full models.Collection shape through the role/count
	// recompute below (which keys lookups by Collection.ID), then
	// project to BootstrapCollection at the end of this section. The
	// projection drops id/workspace_id/timestamps/settings and parses
	// the schema string into a nested object — see BootstrapCollection
	// godoc + PLAN-1410 / TASK-1412.
	collections, err := s.store.ListCollections(workspaceID)
	if err != nil {
		return nil, err
	}
	if visibleIDs != nil {
		filtered := make([]models.Collection, 0, len(collections))
		for _, c := range collections {
			if isCollectionVisible(c.ID, visibleIDs) {
				filtered = append(filtered, c)