fix: enforce role tool whitelist

hub/src/feishu/trigger.ts

@@ -41,6 +41,7 @@ import { ApprovalManager } from "./approval.js";
 import { SenderNameCache } from "./senderCache.js";
 import { TriggerQueue, triggerQueue as defaultTriggerQueue, type QueuedTrigger } from "./triggerQueue.js";
 import { createSlashCommandRegistry, formatSlashHelpTarget, parseSlashHelpSubcommand, parseSlashInvocation } from "./slashCommands.js";
+import { cphHubMcpToolsForRole, roleToolsAllow } from "../agent/roleTools.js";
 
 export { ApprovalManager } from "./approval.js";
 export type { ApprovalResult, PendingApproval } from "./approval.js";
@@ -183,7 +184,8 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
     // Per-role bundle (ADR-0017): systemPrompt seeds persona; tools whitelist
     // is enforced inside runAgent when it builds the SDK tools record. `tools:
     // undefined` means the full registered set (unrestricted role).
-    const systemPrompt = withFileDeliveryInstructions(role?.systemPrompt);
+    const roleTools = role?.tools;
+    const systemPrompt = withFileDeliveryInstructions(role?.systemPrompt, roleTools);
     const feishuTriggerContext = await buildFeishuTriggerContext({
       msg,
       chatId,
@@ -299,6 +301,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       workspaceDir: project.workspaceDir,
       sendOptions,
       approvalManager,
+      tools: cphHubMcpToolsForRole(roleTools),
       onDelivered: (path) => {
         deliveredFiles.push(path);
       },
@@ -315,6 +318,7 @@ export function makeTriggerHandler(deps: TriggerDeps): TriggerHandler {
       systemPrompt,
       providerEnv: provider.sdkEnv,
       resumeSessionId: sessionMetadata.claudeSessionId,
+      tools: roleTools,
       mcpServers: { cph_hub: fileDeliveryMcpServer },
       maxTurns: runPolicy.maxTurns,
       runId: run.id,
@@ -963,7 +967,8 @@ async function senderAuditMetadata(rt: FeishuRuntime, openId: string): Promise<P
   return sender as Prisma.InputJsonObject;
 }
 
-function withFileDeliveryInstructions(systemPrompt: string | undefined): string {
+function withFileDeliveryInstructions(systemPrompt: string | undefined, roleTools: readonly string[] | undefined): string | undefined {
+  if (!roleToolsAllow(roleTools, "send_file")) return systemPrompt;
   const fileDeliveryPrompt =
     "When the user asks you to send, resend, attach, or provide a file, call the cph_hub send_file tool with the actual existing file path. " +
     "Do not say a file is attached or sent unless that tool returns success.";