fix: enforce role tool whitelist

hub/src/agent/models.ts

@@ -17,10 +17,11 @@
  *
  * A role bundles everything that distinguishes one agent persona from another:
  * model, system prompt, and the tool surface (files / cph / feishu / skills /
- * mcps). Per-run tool whitelisting is enforced by {@link ToolRegistry.subset};
- * the model never sees tools outside its role's whitelist, even if it tries to
- * call them — security does not rely on the system prompt.
+ * mcps). Per-run tool whitelisting is enforced by the Claude SDK runner and
+ * the cph_hub MCP server builder; security does not rely on the system prompt.
  */
+import { assertSupportedRoleTools } from "./roleTools.js";
+
 export interface RoleEntry {
   readonly id: string;
   /** Human label for the teacher-side switcher UX. */
@@ -36,7 +37,7 @@ export interface RoleEntry {
   /**
    * Tool names this role may use (whitelist). `undefined` ⇒ the full registered
    * set (back-compat / unrestricted roles). An empty array ⇒ no tools at all.
-   * Names not present in the registry are silently dropped at run setup.
+   * Invalid names fail fast when settings are loaded or the run is set up.
    */
   readonly tools?: readonly string[] | undefined;
 }
@@ -72,6 +73,9 @@ export class InMemoryModelRegistry implements ModelRegistry {
 
   constructor(models: readonly ModelEntry[], roles: readonly RoleEntry[] = []) {
     this.models = models;
+    for (const role of roles) {
+      if (role.tools !== undefined) assertSupportedRoleTools(role.tools);
+    }
     this.roles = new Map(roles.map((r) => [r.id, r]));
   }