fix: enforce role tool whitelist

hub/src/feishu/fileDeliveryTool.ts

@@ -1,9 +1,10 @@
-import { createSdkMcpServer, tool, type McpSdkServerConfigWithInstance } from "@anthropic-ai/claude-agent-sdk";
+import { createSdkMcpServer, tool, type McpSdkServerConfigWithInstance, type SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
 import { z } from "zod";
 import { sendApprovalCard, sendFile, type FeishuRuntime, type SendMessageOptions } from "./client.js";
 import { resolveDeliverableFile } from "./fileDelivery.js";
 import { readFeishuContext } from "./read.js";
 import type { ApprovalManager } from "./approval.js";
+import { CPH_HUB_MCP_TOOL_IDS, type CphHubMcpToolId } from "../agent/roleTools.js";
 
 export interface FileDeliveryToolOptions {
   readonly rt: FeishuRuntime;
@@ -14,20 +15,15 @@ export interface FileDeliveryToolOptions {
   readonly sendOptions?: SendMessageOptions | undefined;
   readonly approvalManager: ApprovalManager;
   readonly onDelivered?: (path: string) => void;
+  readonly tools?: readonly CphHubMcpToolId[] | undefined;
 }
 
 export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): McpSdkServerConfigWithInstance {
-  return createSdkMcpServer({
-    name: "cph_hub",
-    version: "0.0.0",
-    alwaysLoad: true,
-    instructions:
-      "Use send_file when the user asks to receive, resend, download, or attach a file. " +
-      "Do not claim a file was sent unless send_file returns success. " +
-      "If a generated file path is uncertain, list or inspect the workspace first, then call send_file with the actual path. " +
-      "Use feishu_read_context when the trigger context contains a reply, thread, or message anchor and more Feishu context is needed. " +
-      "Use request_approval when explicit human approval or confirmation is required before continuing.",
-    tools: [
+  const enabledTools = new Set(options.tools ?? CPH_HUB_MCP_TOOL_IDS);
+  const tools: Array<SdkMcpToolDefinition<any>> = [];
+
+  if (enabledTools.has("send_file")) {
+    tools.push(
       tool(
         "send_file",
         "Upload an existing project/repository file to the current Feishu chat. The path must point to a concrete file, for example build/student.pdf or README.md.",
@@ -59,6 +55,11 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
         },
         { alwaysLoad: true },
       ),
+    );
+  }
+
+  if (enabledTools.has("feishu_read_context")) {
+    tools.push(
       tool(
         "feishu_read_context",
         "Read Feishu context for the current project's bound chat. Use anchor ids from the trigger context; this tool never reads arbitrary chats.",
@@ -81,6 +82,11 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
         },
         { alwaysLoad: true },
       ),
+    );
+  }
+
+  if (enabledTools.has("request_approval")) {
+    tools.push(
       tool(
         "request_approval",
         "Send an interactive Feishu approval/confirmation card to the current chat and wait for a button click.",
@@ -128,6 +134,33 @@ export function createFileDeliveryMcpServer(options: FileDeliveryToolOptions): M
         },
         { alwaysLoad: true },
       ),
-    ],
+    );
+  }
+
+  const instructions = mcpInstructions(enabledTools);
+  return createSdkMcpServer({
+    name: "cph_hub",
+    version: "0.0.0",
+    alwaysLoad: true,
+    ...(instructions === "" ? {} : { instructions }),
+    tools,
   });
 }
+
+function mcpInstructions(enabledTools: ReadonlySet<CphHubMcpToolId>): string {
+  const instructions: string[] = [];
+  if (enabledTools.has("send_file")) {
+    instructions.push(
+      "Use send_file when the user asks to receive, resend, download, or attach a file.",
+      "Do not claim a file was sent unless send_file returns success.",
+      "If a generated file path is uncertain, list or inspect the workspace first, then call send_file with the actual path.",
+    );
+  }
+  if (enabledTools.has("feishu_read_context")) {
+    instructions.push("Use feishu_read_context when the trigger context contains a reply, thread, or message anchor and more Feishu context is needed.");
+  }
+  if (enabledTools.has("request_approval")) {
+    instructions.push("Use request_approval when explicit human approval or confirmation is required before continuing.");
+  }
+  return instructions.join(" ");
+}